Write the Agent Platform TLS default unless a caller turns it off

ai-settings wrote the Agent Platform service's TLS setting as off on every call, while GitLab ships it on (self_hosted_duo_agent_platform_service_secure, default true). A hand call meant to put an instance back on the product's settings still left TLS off, and no call site said that it wanted it off.

ai-settings now writes on unless its third argument is false, and refuses any other value. aigw start and dap-bootstrap pass false, because the gateway the simulator starts serves the service on :50052 with no certificate, so a default run writes what it wrote before. gce.md gives the reason beside the other DWS wiring conditions.

engine-selftest checks the default, the refusal and both callers, and six of its seven new checks fail on the old engine.