chore(function-autoscaler): add TimeseriesDB mTLS support

[borao]

TL;DR

Adds mTLS support for function autoscaler TimeseriesDB queries while preserving the existing token and local auth modes.

Additional Details (optional for docs, build, test, refactor, ci, chore, style, and revert PRs)

• Adds an explicit auth_mode setting with legacy disable_auth compatibility.
• Loads a native TLS client identity from configured certificate and private key paths for mtls.
• Uses the Prometheus /api/v1/query_range path for direct/local modes and keeps the legacy /v1/query_range path for token auth.
• Validates mTLS identity inputs and covers key mismatch, expired certs, malformed keys, URL shape, and query path selection.

For the Reviewer

• Start with timeseries_db_client.rs for the client setup and request path behavior.
• Please sanity-check the config compatibility in effective_auth_mode.

For QA (optional for docs, build, test, refactor, ci, chore, style, and revert PRs)

cargo test -p rs-autoscaler

Result: 116 passed, 0 failed, 11 ignored.

Issues

NO-REF

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[dmikhaylovnv]

I assume the Identity secret is never rotating and we don't need to use SecretFileWatcher

[dmikhaylovnv]

Over all LGTM, left minor comment.