verify Kafka broker TLS certificate by default

When SASL credentials are present, getClient() connected with
`rejectUnauthorized: false`, so the SASL password was sent over a TLS
connection whose broker certificate was never verified — a MITM could
present any certificate and capture the credentials.

Verify by default; set KAFKA_SSL_ALLOW_UNAUTHORIZED=true to opt out for
self-signed brokers.

src/lib/kafka.ts

@@ -47,7 +47,7 @@ function getClient() {
     username && password
       ? {
           ssl: {
-            rejectUnauthorized: false,
+            rejectUnauthorized: process.env.KAFKA_SSL_ALLOW_UNAUTHORIZED !== 'true',
           },
           sasl: {
             mechanism,