gRPC: Enable HTTP endpoint with TLS support

[carbolymer]

Description

Adds configuration for the node's gRPC server to listen over HTTP/2 instead of only a unix socket, in plaintext (h2c) or with TLS.

• New CLI flags --grpc-listen-address/--grpc-listen-port (config keys RpcListenAddress/RpcListenPort) switch the server from the unix socket to HTTP/2.
  The listen address accepts an IPv4 or IPv6 address and defaults to 127.0.0.1.
• New CLI flags --grpc-tls-certificate/--grpc-tls-private-key/--grpc-tls-chain-certificate (config keys RpcTlsCertificateFile/RpcTlsPrivateKeyFile/RpcTlsChainCertificateFiles) switch the HTTP/2 endpoint to TLS.
• Conflicting or incomplete combinations are rejected at configuration parse time.
  For example, a unix socket path together with a listen port, or a TLS private key without a certificate.
• A new RPC.ServerListening trace announces the endpoint the gRPC server is listening on at startup.

Also fixes --port and the tracer socket CLI options.
They previously parsed port numbers with a plain Int/Word16 read and silently wrapped out-of-range values, for example 70000 became 4464.
They now reject out-of-range and non-decimal input.

This PR also carries two changes that cannot ship separately from the endpoint work:

• The bump to cardano-api 11.7 and cardano-rpc 11.3 (both released to CHaP today), together with the CHaP index and flake pin update.
  cardano-rpc 11.3 replaced the socket path in RpcConfigF with the RpcEndpoint type, so the bump only compiles with the endpoint changes here, and the endpoint changes only compile against 11.3.
• The UTxO RPC test update for the latest v1beta spec, previously gRPC: update tests for latest v1beta UTXORPC #6666.
  The spec made the FetchBlock request reference and response block fields repeated, so the old test does not compile against cardano-rpc 11.3 and the updated one does not compile against 11.2.

Checklist

• Commit sequence broadly makes sense and commits have useful messages
• New tests are added if needed and existing tests are updated. These may include:
  • golden tests
  • property tests
  • roundtrip tests
  • integration tests
    See Running tests for more details
• Any changes are noted in the CHANGELOG.md for affected package
  • cardano-node-chairman, cardano-submit-api and cardano-testnet instead need a
    changelog fragment in <package>/.changes/, because their CHANGELOG.md is generated
    from fragments at release time. Copy _TEMPLATE.yml from that directory, or run
    nix run github:input-output-hk/cardano-dev#herald -- new
• The version bounds in .cabal files are updated
• CI passes. See note on CI. The following CI checks are required:
  • Code is linted with hlint. See .github/workflows/check-hlint.yml to get the hlint version
  • Code is formatted with stylish-haskell. See .github/workflows/stylish-haskell.yml to get the stylish-haskell version
  • Code builds on Linux, MacOS and Windows for ghc-9.6 and ghc-9.12
• Self-reviewed the diff

Note on CI

If your PR is from a fork, the necessary CI jobs won't trigger automatically for security reasons.
You will need to get someone with write privileges. Please contact IOG node developers to do this
for you.