nsqd: change --tls-required to a new tlsRequiredOption type

The new tlsRequiredOption takes "true", "false", and "tcp-https".
"true" and "false" (and variations allowed by ParseBool) allow backwards
compatibility.

The new "tcp-https" option allows users to require tls on only the
https/tcp ports, but to bypass tls on the http port.

Somebody could set up nsqd on a server, expose the tcp/https ports,
lockdown the http port, and allow localhost programs to post to nsqd
without adding support for certs/ssl.