With istiod, we can do tls without the "controlPlaneSecurity" option (a bit confusing, but its actually still secure). We only need that if migrating from 1.4 with controlPlaneSecurity, so we can default it off and add an upgrade note.