Currently, the TLS auto-join/init code in pkg/{server,security}/auto_tls_init.go uses
CertsLocator directly and does file-level reads/writes. Many of these instances,
especially in the read path, can and should use CertificateManager instead.
This allows for easier testing as well as less code repetition.

Stems from #60632. Related to, but distinct from, #64883

Jira issue: CRDB-7326
Epic: CRDB-6663