Wire up TLS flags for etcdctl

Other than the obvious features, there are two notable changes:
1. go-etcd sets `net/http#Transport.TLSClientConfig.InsecureSkipVerify = true`. With the changes here, InsecureSkipVerify is effectively now `false`. If we want to preserve this behavior, we need to add a new flag like `--tls-no-verify`.
2. Addition of `SyncableHTTPClient.Endpoints()` to keep parity with the logging in the rest of etcdctl after a sync operation
3. `pkg/transport#TLSInfo.ClientConfig` now ignores CertFile and KeyFile if neither are set, so RootCAs can be set without having a full client identity.

Fix #1589