Use Let's Encrypt to secure thanos gRPC communications

The thanos grpc client only knows to encrypt no client communicatons, or
to encrypt all client communications. As the external thanos components
will need to be deployed behind TLS, we need to also deploy TLS for
internal components for consistency.

The alternative would be deploying gRPC client proxies that would be
able to handle TLS decapsulation, e.g. envoy or nginx, which seems
pretty heavy-handed.