docs: add 8.14 TLS 1.2 RSA handshake breaking change (#20880)

* docs: add 8.14 TLS 1.2 RSA handshake breaking change note

Document that TLS 1.2 RSA key exchange cipher negotiation can fail at runtime in 8.14+ due to Go 1.22 defaults, and include the GODEBUG workaround.

Made-with: Cursor

* docs: add breaking change entry to 8.14 release notes

Add a dedicated Breaking Changes section to 8.14.0 release notes documenting TLS 1.2 RSA key exchange runtime handshake failures and the GODEBUG workaround.

Made-with: Cursor

* docs: reorder 8.14 breaking change section

Move the 8.14 breaking changes block ahead of 8.11 to keep release sections in descending version order.

Made-with: Cursor

* docs: align 8.14 breaking-change format with existing style

Reformat the 8.14 all-breaking-changes entry to use the standard bullet-and-details style used by nearby 8.x sections.

Made-with: Cursor
(cherry picked from commit 0605cf3)

Author: carsonip

changelogs/8.14.asciidoc

@@ -44,6 +44,10 @@ https://github.com/elastic/apm-server/compare/v8.13.2\...v8.14.0[View commits]
 ==== Bug fixes
 - Remove error reason from logs when Elasticsearch returns unavailable_shards_exception {pull}13287[13287]
 
+[float]
+==== Breaking Changes
+- TLS 1.2 handshakes with RSA key exchange ciphers can fail at runtime (for example, `AES128-GCM-SHA256`) even when startup succeeds, due to Go 1.22 default TLS behavior. Workaround: set `GODEBUG=tlsrsakex=1` on the APM Server process. {issue}20879[20879]
+
 [float]
 ==== Added
 - OpenTelemetry Distro Name will now be used for `agent.name` and `agent.version` {pull}12940[12940]

changelogs/all-breaking-changes.asciidoc

@@ -7,6 +7,18 @@
 This section describes the breaking changes and deprecations introduced in this release
 and previous minor versions.
 
+// tag::814-bc[]
+[float]
+[[breaking-changes-8.14]]
+=== 8.14
+
+The following breaking changes are introduced in APM version 8.14.0:
+
+- TLS 1.2 handshakes with RSA key exchange ciphers can fail at runtime (for example, `AES128-GCM-SHA256`) even when startup succeeds, due to Go 1.22 default TLS behavior. Workaround: set `GODEBUG=tlsrsakex=1` on the APM Server process.
+
+For more details, see https://github.com/elastic/apm-server/issues/20879[Issue #20879].
+// end::814-bc[]
+
 // tag::811-bc[]
 [float]
 [[breaking-changes-8.11]]