pd: 🔨 rework RootCommand::start auto-https logic

```
         /!\ this is a work in progress and will    /!\
         /!\ be force pushed until ready for review /!\
```

fixes #3627.

this reorganizes the logic in pd's startup code related to automatically
managed https functionality. in particular, this is done in such a
manner as to expose an axum `Router` that will permit later work
(#3646, #3522) to serve other additional routes from our grpc
endpoint.

Refs: #3627
Refs: #3646
Refs: #3522