docs(8.8): document Zeebe TLS migration settings

[eamonnmoloney]

Summary

• Documents the standalone migration importer TLS settings needed during 8.7 -> 8.8 dual-region upgrades.
• Clarifies that embedded gateway TLS settings do not replace ZEEBE_GATEWAY_CLUSTER_SECURITY_* for migration pods.
• Shows the separate TLS Secret mounts for orchestration, importer, and data migration pods.

Validation

• npx prettier --check versioned_docs/version-8.8/self-managed/upgrade/helm/870-to-880-dual-region.md
• Helm counterpart GKE repo-backed validation passed for esss upgrade in 11m31s
• Seeded-data GKE validation passed in namespace inc33081-h7-data-gke:
  • deployed 8.7 with Elasticsearch self-signed TLS plus Zeebe TLS
  • seeded real process data with tests/SM-8.7/smoke-tests.spec.ts / Most Common Flow User Flow With All Apps
  • upgraded the same namespace to 8.8 with features migrator,zeebe-tls
  • migration job completed with operate-import-position-8.3.0_ total=36 pending=0 and tasklist-import-position-8.2.0_ total=19 pending=0
  • importer logs showed gateway cluster messaging started using TLS

Links

• Originating issue: SUPPORT-33081 / INC-5824
• Helm counterpart: test(8.8): cover Zeebe TLS migration upgrade camunda-platform-helm#6281
• E2E counterpart: not needed