Fix TLS support in private API server

Fixes #357 (closed).

Instead of reusing private API server with the in-memory listener, this MR uses a new gRPC server.

I tried to use the existing server to optimize resource usage. Unfortunately, it doesn't work because if kas is configured with TLS for private API server, then in-memory client is still talking to the server over a cleartext connection. We can either encrypt the traffic (i.e. reconfigure the client in-memory connection) or use a separate server and always use cleartext traffic. This MR takes the second approach to avoid paying the encryption/decryption cost.