Explain the openldap-tls SecretClass in the LDAP tutorial (#861)

* Explain the openldap-tls SecretClass in the LDAP tutorial

The AuthenticationClass references an openldap-tls SecretClass for TLS
server verification that the tutorial-openldap stack creates silently.
Explain what it is and link to the TLS server verification concepts page
so readers know how to create one for a real LDAP server.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Clarify the openldap-tls SecretClass uses autoTls vs k8sSearch for real servers

The tutorial-openldap stack creates openldap-tls as an autoTls/autoGenerate
SecretClass: the Secret Operator owns the CA and uses it both to issue
OpenLDAP's server cert and to verify it. Contrast this with a real LDAP
server, where you only have the server's CA cert and use the k8sSearch
backend instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Add trailing newline to ldap-authenticationclass.yaml

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: lfrancke

modules/tutorials/examples/ldap-auth/ldap-authenticationclass.yaml

@@ -15,4 +15,4 @@ spec:
         verification:
           server:
             caCert:
-              secretClass: openldap-tls
+              secretClass: openldap-tls  # <4>

modules/tutorials/pages/authentication_with_openldap.adoc

@@ -120,10 +120,21 @@ include::example$ldap-auth/ldap-authenticationclass.yaml[]
 <1> The name of the AuthenticationClass, which needs to be referenced later
 <2> The hostname in this case is the Service at which the OpenLDAP is running, inside of Kubernetes.
 <3> Here the SecretClass name is referenced
+<4> A SecretClass used to verify the LDAP server's TLS certificate, see below.
 
 // [source,bash]
 // include::example$ldap-auth/30-install-openldap.sh[tag=apply-ldap-authenticationclass]
 
+The AuthenticationClass connects to LDAP over TLS (port `1636`) and verifies the server's certificate against the CA provided by the `openldap-tls` SecretClass.
+You did not have to create that SecretClass: the `tutorial-openldap` stack created it for you.
+It uses the `autoTls` backend with `autoGenerate: true`, so the Secret Operator generates its own certificate authority and uses it both to issue OpenLDAP's server certificate and to let the products verify that certificate.
+This works because the Secret Operator owns the CA, including its private key, from end to end.
+
+Connecting to a *real* LDAP server is different: you do not control the server's certificate and usually only have its CA certificate, not the CA's private key.
+In that case you create the SecretClass yourself using the `k8sSearch` backend, which simply makes the existing CA certificate available to the products.
+A SecretClass used only for server verification needs nothing but the CA certificate; it does not need a key.
+See xref:concepts:tls-server-verification.adoc[] for a complete, copy-pasteable example.
+
 Remember the name of the AuthenticationClass (`openldap`), you will use it in the next steps when configuring the products.
 
 [#superset]