etcd: refactor TLS configuration

Separate reading files from creating a TLS config object.