Enabling AutoTLS feature by default

[lidel]

Context

In #10521 we've introduced opt-in AutoTLS feature which uses DNS and p2p-forge infrastructure run by Interplanetary Shipyard to automate TLS setup for libp2p WebSocket transport.

This feature will not yield the maximum benefit to the swarm unless it is enabled by default, just like /webtransport and /webrtc-direct listeners are.

This issue tracks remaining work towards enabling AutoTLS by default.

TODO

• feat(AutoTLS): opt-in WSS certs from p2p-forge at libp2p.direct #10521 (landed in kubo 0.32.0-rc1)
• libp2p.direct public good infra accepts registrations
• fix(autotls): store certificates at the location from the repo path #10566
• disable AutoTLS in test profile
• add opt-in flag AutoTLS.EnableTBD that adds catch-all listener /tcp/400X/tls/sni/*.libp2p.direct/ws if Addresses.* (swarm, announce, appendAnnounce) have no /tls/sni or /wss
• /ws listener can share the same port as /tcp (4001)
  • feat(tcpreuse): add options for sharing TCP listeners amongst TCP, WS and WSS transports libp2p/go-libp2p#2984
  • add /tcp/4001/tls/sni/*.libp2p.direct/ws to default listeners created by ipfs init
  • add repo/config migration that adds /tls/sni/*.libp2p.direct/ws listener for existing users
• AutoTLS: attempts to get cert when not publicly diallable #10570
  • detect when behind NAT, and delay the initial registration attempt until a publicly dialable address is confirmed by AutoNAT (avoid ERROR in logs when we know it will fail anyway)
  • do not attempt getting cert if we depend on /p2p-circuit addrs
  • do not attempt getting cert if the only "public addr" is ipv6 blocked by firewall
• some sort of smoke-test E2E test/cli that gets cert from AutoTLS.CAEndpoint=https://acme-staging-v02.api.letsencrypt.org/directory (certmagic.LetsEncryptStagingCA) and confirms it is placed in IPFS_PATH/p2p-forge-certs/certificates/?
• libp2p.direct productization by Shipyard is finished
• docs(websockets): include explicit /sni/ example libp2p/specs#639