types: move TLS config under tls with legacy fallback

tls.cert_path, tls.key_path and tls.acme.* replace the flat keys, which
still work. Warn on them only when they turn TLS on: NixOS always sets them.

Updates #2527

.github/actions/headscale-up/action.yml

@@ -83,8 +83,9 @@ runs:
           nameservers:
             global:
               - 1.1.1.1
-        tls_cert_path: /tmp/hs/tls.crt
-        tls_key_path: /tmp/hs/tls.key
+        tls:
+          cert_path: /tmp/hs/tls.crt
+          key_path: /tmp/hs/tls.key
         policy:
           mode: file
           path: /tmp/hs/policy.hujson