Release Notes and Documentation Update on mTLS for APIM 4.0.0 and Later.

[SameeraSI]

Hi Team,

From version 4.0.0 onwards, there has been a change in mTLS behavior in APIM. Specifically, if mTLS is enabled for an API, only HTTPS should be used. This change means that users cannot use mTLS if they are performing SSL termination at the load balancer[1].

SSL termination at the load balancer is a common practice. However, this change was not documented with proper explanations and reasons, even in the release notes.

We need to update the release notes and the official documentation to include this change and the reasons behind it with the standards considered during this change.

[1] https://apim.docs.wso2.com/en/4.2.0/design/api-security/api-authentication/secure-apis-using-mutual-ssl/#handling-mtls-when-ssl-is-terminated-by-the-load-balancer-or-reverse-proxy

Thanks,
Sameera