fix: when only tls.verify, skip the logic of judging client cert

[SkyeYoung]

Description

In #7046, a tls.verify property, only applicable to Kafka, was added to the upstream schema without being documented or reflected in the API. There's also a lack of handling for this property in other resources that use upstream.

So in this PR, I've added that when using non-Kafka HTTPS or gRPCs upstream, the client certificate related processing logic should be skipped when only tls.verify.

Considering that only the parts below in reference tls, and there are no filter-like functions provided by Lua, it's changed to check for the existence of tls.client_cert_id or tls.client_cert.

apisix/apisix/upstream.lua

Lines 265 to 273 in 0dde705

	if (scheme == "https" or scheme == "grpcs") and tls_has_cert then
	local client_cert, client_key
	if up_conf.tls.client_cert_id then
	client_cert = api_ctx.upstream_ssl.cert
	client_key = api_ctx.upstream_ssl.key
	else
	client_cert = up_conf.tls.client_cert
	client_key = up_conf.tls.client_key
	end

Which issue(s) this PR fixes:

Fixes #12501

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

[Copilot]

Pull Request Overview

This PR fixes an issue where non-Kafka HTTPS/gRPCS upstreams were incorrectly processing TLS certificate logic when only tls.verify was specified. The change ensures that certificate-related processing is only triggered when actual client certificates are provided.

• Modifies the TLS processing condition to check for the presence of client_cert or client_cert_id rather than just the existence of the tls object
• Adds comprehensive test coverage for the tls.verify-only scenario
• Updates documentation to clarify that tls.verify is currently only supported for Kafka upstreams

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
apisix/upstream.lua	Updates condition to skip certificate processing when only tls.verify is present
t/node/upstream-mtls.t	Adds test cases for tls.verify-only and combined scenarios
t/core/schema_def.t	Adds schema validation test for tls.verify property
docs/en/latest/admin-api.md	Documents the tls.verify property with Kafka limitation
docs/zh/latest/admin-api.md	Documents the tls.verify property with Kafka limitation in Chinese

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[bzp2010]

codes and tests lgtm