docs(opcua): drop misleading TOFU label from accept-any cert example

The reject_untrusted: false path uses AcceptAll, which pins nothing and
re-accepts any server cert on every connect. Calling it TOFU overstated
its security and contradicted the corrected code comments and the env-var
table. Relabel it as INSECURE, lab only, not trust-on-first-use.

Author: mfaferek93

src/ros2_medkit_plugins/ros2_medkit_opcua/README.md

@@ -265,7 +265,7 @@ plugins.opcua.client_cert_path: "/etc/ros2_medkit/opcua/client_cert.der"  # X.50
 plugins.opcua.client_key_path:  "/etc/ros2_medkit/opcua/client_key.pem"   # private key, PEM
 plugins.opcua.application_uri:  "urn:selfpatch:medkit:opcua-client"        # MUST match the cert SAN URI
 plugins.opcua.trust_list_paths: ["/etc/ros2_medkit/opcua/server_cert.der"]  # DER trust store
-plugins.opcua.reject_untrusted: true                   # false = accept any server cert (lab/TOFU only)
+plugins.opcua.reject_untrusted: true                   # false = accept ANY server cert (INSECURE, lab only; not trust-on-first-use, nothing pinned)
 plugins.opcua.user_auth_mode: "UsernamePassword"       # Anonymous | UsernamePassword | X509
 plugins.opcua.username: "medkit"
 plugins.opcua.password: "..."                           # inject from a secret store at deploy time