Fix client verification and wording

Per https://github.com/bitly/go-nsq/commit/5429f88b67f4593dba706e84dd7631004ea2714a#commitcomment-7481700,
"When the tls.Config is used for a TLS client, it should be setting c.TlsConfig.RootCAs,
not .ClientCAs; otherwise there will be no possible roots to verify the server cert."

Because we do not know whether the config will be used as a producer or a consumer,
the easiest fix is to set both the RootCAs and ClientCAs to the same tlsCertPool.
Only one will actually be used.

Lastly, the cert is public, not private, and the key is private, not public.
Good point.