feat(kafka-logger): add TLS support for Kafka brokers

[ecsimsw]

Description

• Add TLS option to kafka-logger and error-log-logger plugins for connecting to TLS-enabled Kafka brokers such as AWS MSK.
• APISIX uses lua-resty-kafka for Kafka produce, and lua-resty-kafka already supports ssl/ssl_verify in broker_config.
• However, APISIX plugins were not exposing these options to users.
• This PR adds a tls object schema so users can enable TLS connections.
• The tls object design allows future extension for mTLS support.

Changes

• kafka-logger.lua : add tls schema + pass ssl/ssl_verify to broker_config
• error-log-logger.lua : same change
• kafka-logger-tls.t : schema validation + integration tests via SSL port (9093)
• error-log-logger-kafka.t : schema validation + integration tests for TLS
• kafka-logger.md, error-log-logger.md : add tls attributes and usage examples

Which issue(s) this PR fixes:

• Fixes kafka security_protocol Does kafka support SASL_SSL? #9353

Verification

• Tested against AWS MSK (Real world, TLS-only) : TLS handshake and metadata fetch confirmed working.
• luacheck: passed locally (0 warnings / 0 errors)
• check-test-code-style.sh: passed locally
• lj-releng: requires LuaJIT 2.1 (not available locally), to be verified by CI

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

[juzhiyuan]

Hi, thank you for your contribution.

I looked through the historical APISIX issues related to this topic and agree that this is a reasonable fix. A previous issue, #9353, was closed by the bot as stale.

Also, services such as AWS MSK require TLS, which means kafka-logger cannot work properly in those environments before this PR is accepted. Also I notice that https://github.com/ecsimsw/apisix/blob/841dbea7a167684e6b9834c33e841ea61693a100/apisix/pubsub/kafka.lua#L83 already supports TLS, while kafka-logger does not.

So I think this is a valid request.

[juzhiyuan]

@ecsimsw some CI fails - do you have time to fix it before further reviewing?

[ecsimsw]

@juzhiyuan
Hi, thank you for reviewing.
It's exciting to contribute to a project that I've been actively using at work.

I've checked the CI failures.
The plugin test environment does not have a Kafka SSL listener, so the TLS integration tests could not connect.
The schema validation tests pass fine.

The last test environment already has Kafka SSL configured.
I can add the SSL config following the last environment setup,
but since it's shared infrastructure, I'd like to get your opinion before making changes.

1. Add Kafka SSL to the plugin test environment, similar to the last environment.
2. Keep only schema validation tests — consistent with how SASL tests are structured.

Which approach would you prefer?

**
For now, I've removed the TLS integration tests and kept only the schema validation tests.
If you or other maintainers would like to add the SSL Kafka setup to the plugin CI environment, I'm happy to follow up on that.

[ecsimsw]

Hi @juzhiyuan, just a friendly follow-up — CI is green now.
Let me know if there's anything else needed for review.
Thanks!

[juzhiyuan]

Hi @ecsimsw, thanks for your following up! I will request reviews from team next monday.