tls: report negotiated TLS groups

[panva]

tlsSocket.getEphemeralKeyInfo() currently returns an empty object for TLS 1.3 key agreement groups where OpenSSL does not expose a peer temporary key object, including ML-KEM and hybrid ML-KEM groups.

This updates the shared TLS helper to fall back to OpenSSL's negotiated TLS group name and return { type: 'TLSGroup', name: '<group>' }.

The existing DH and ECDH result shapes are unchanged and still take precedence when OpenSSL provides a recognizable temporary key. TLSGroup does not include size, because Node cannot derive a meaningful single key size for PQ or hybrid groups.

The TLS docs now describe TLSGroup, point users to the IANA TLS Supported Groups registry, and clarify that the historical ecdhCurve option also configures TLS Supported Groups for TLS 1.3.

Fixes: #59452