Broker connection security. Key names mirror Spring Boot's own spring.kafka.security.* so env overrides bind identically (SPRING_KAFKA_SECURITY_PROTOCOL / KAFKA_SECURITY_PROTOCOL via yml).
spring.kafka.security.*
PLAINTEXT (default, local dev) or SSL (cluster listener :9094).