Workhorse: Support listening on TLS for incoming requests

Currently Workhorse listens on an unencrypted HTTP port or UNIX socket from NGINX:

We'll want to be able to support TLS here: https://gitlab.com/gitlab-org/gitlab/blob/c82a66e14df6a61d7a72a5c91e63ec3829f9f1f2/workhorse/main.go#L182-186