Allow the proxy public listener protocol to differ from the advertised one (server config)

[ndr-ds]

Motivation

linera-proxy binds its public listener from validator.network.protocol — the same field the committee advertises to clients. When an ingress in front of the proxy (e.g. an Envoy Gateway with a real certificate) terminates TLS, the two roles diverge: clients must keep dialing tls, while the proxy itself must listen in cleartext (its only TLS identity is the self-signed CERT_PEM baked into the binary, which webpki-validating clients reject anyway). Today the only way to express that is post-editing server_N.json after linera-server generate.

Proposal

A config field, not a CLI flag (reviewer feedback): ValidatorServerConfig gains an optional public_listen_protocol (serde-defaulted and skipped when None, so every existing server.json parses AND serializes unchanged). linera-server generate accepts the same optional field in validator_N.toml and writes it through, so deployments express the topology at mint time — no post-editing. The proxy binds its public listener with public_listen_protocol.unwrap_or(advertised); setting it on a non-gRPC network fails explicitly. Absent field = behavior identical to today.

Test Plan

• cargo clippy -p linera-client -p linera-service --all-targets -- -D warnings clean; cargo +nightly fmt.
• test_validator_options (extended TOML round-trip) passes.
• CI.

Release Plan

These changes follow the usual release cycle.

Links

• https://github.com/linera-io/linera-infra/pull/1472 (infra mint currently post-edits server_N.json; this field replaces that jq)