Server-side *-crl flags are silently ignored when the TLS cert and key are not configured

Overview of the Issue

The server-side CRL flags are silently ignored when the server is not configured for TLS. --grpc-crl (servenv) and --mysql-server-ssl-crl (vtgate) are only ever read inside vttls.ServerConfig, and both call sites invoke it only when the certificate and key flags are set:

• go/vt/servenv/grpc_server.go:219: if gRPCCert != "" && gRPCKey != "" { config, err := vttls.ServerConfig(gRPCCert, gRPCKey, gRPCCA, gRPCCRL, ...) }
• go/vt/vtgate/plugin_mysql_server.go:1926: if mysqlSslCert != "" && mysqlSslKey != "" { ... initTLSConfig(..., mysqlSslCrl, ...) }

So an operator who sets --grpc-crl or --mysql-server-ssl-crl without the matching cert/key gets a plaintext gRPC server, or a MySQL server without TLS, and nothing warns that the CRL was never applied.

#21054 made ServerConfig fail closed when a CRL is configured without a CA, and made the gRPC client side connect with TLS rather than in plaintext when a *-grpc-crl is set without a certificate or CA. The server side did not get the equivalent treatment: the new check at go/vt/vttls/vttls.go:263 cannot run if ServerConfig is never reached. This is pre-existing behavior, not a regression from #21054; it was noticed by Copilot while reviewing the release-24.0 backport (#21113, thread).

Expected

A *-crl flag that cannot be applied as configured should refuse to start, consistently with how #21054 treats a CRL without a CA, an empty CRL file, or a CRL its issuer cannot validate: validate the flag combination before the cert/key gate, or call ServerConfig whenever a CRL is set so its own checks run. Whether a stray --grpc-crl should turn a deliberately plaintext gRPC server into a startup error, or just a loud warning, is the design question to settle here; the client side chose the strict option.

Reproduction Steps

vtgate --grpc-crl /path/to/crl.pem   # no --grpc-cert / --grpc-key

Starts and serves gRPC in plaintext; the CRL is never read. Same with --mysql-server-ssl-crl without --mysql-server-ssl-cert/--mysql-server-ssl-key.

Binary Version

main (after #21054), and every release branch #21054 is backported to.