TLS Verification Bugfixes

[HridoyRoy]

The crux of the matter is:

1. diagnose.Error does NOT set the error status of the span or fail the span. diagnose.Fail does that.
2. sanitizedListeners simply doesn't include listeners that failed the initListeners check. We are using instead the unsanitized listeners for the TLS verification checks.
3. diagnose.Fail combined with diagnose.Error in a particular check caused the output to only print out warnings, but NOT set status. This is because in the output code, if there were warnings the check name and status of the span were not printed (they were skipped).

In addition to these 3 things, I also removed some diagnose calls in production code (that code was meant to be cleaned up in a separate PR), and moved the listener TLS checks that were in operator_diagnose.go into the diagnose package.

[swayne275]

I think it looks good! A few small comments then re-request and I'll approve