fix(sources): default ALPN to h2 for gRPC-based sources when TLS is enabled

[vladimir-dd]

Summary

gRPC always runs over HTTP/2, and HTTP/2 clients require the server to confirm h2 via ALPN post-handshake (RFC 7540 Section 3.3). None of Vector's gRPC-based sources (e.g. opentelemetry) expose an alpn_protocols config option, so when TLS is enabled without one, strict gRPC clients (e.g. Go's grpc-go ≥ v1.67, and by extension grpc-go-based tools/proxies) fail the handshake with:

rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: credentials: cannot check peer: missing selected ALPN property."

This adds TlsSettings::set_default_alpn_protocols / MaybeTlsSettings::set_default_alpn_protocols, which set a default ALPN protocol list only if the user hasn't already configured tls.alpn_protocols explicitly, and calls it with ["h2"] from the shared run_grpc_server/run_grpc_server_with_routes helpers in src/sources/util/grpc/mod.rs. Fixing it at that shared layer means every current and future gRPC-based source gets the correct default without needing per-source config plumbing.

This is narrowly scoped to TLS: plaintext gRPC (h2c) has no ALPN step at all (ALPN is a TLS-handshake-only extension per RFC 7301), so it's unaffected and continues to work as before.

Related prior ALPN-default bugs fixed in this codebase, for context: #18842/#18843 (http_server source didn't honor tls.alpn_protocols) and #25805/#25807 (mqtt sink hardcoded ALPN instead of honoring tls.alpn_protocols).

Vector configuration

sources:
  otel:
    type: opentelemetry
    grpc:
      address: 0.0.0.0:4317
    http:
      address: 0.0.0.0:4318
    tls:
      enabled: true
      crt_file: server.crt
      key_file: server.key

How did you test this PR?

• Added unit tests in lib/vector-core/src/tls/settings.rs covering: default ALPN applies when unset, explicit alpn_protocols config is preserved (not overridden), and MaybeTlsSettings::set_default_alpn_protocols is a no-op when TLS is disabled.
• cargo test -p vector-core --lib tls::settings::test — 18/18 pass.
• cargo test --lib --features sources-opentelemetry sources::opentelemetry — 24/24 pass.
• cargo clippy -p vector-core --lib -- -D warnings — clean.
• Reproduced the original failure end-to-end with a real TLS-enabled gRPC client against the opentelemetry source's gRPC listener: confirmed the exact missing selected ALPN property handshake failure before this change, and confirmed a successful handshake/export after.

Is this a breaking change?

• Yes
• No

Does this PR include user facing changes?

• Yes. Changelog fragment added at changelog.d/grpc_sources_default_alpn_h2.fix.md.
• No.

References

Notes

Generated with Claude Sonnet 5 as a coding assistant; I've read, tested, and take ownership of these changes per the AI Policy. Opening as a draft first to get early feedback on the approach (fixing at the shared run_grpc_server layer vs. per-source) before requesting review.