Clarify where to place x509 field set

[andrewkroh]

Description of the issue:

The ECS docs say

When only a single certificate is logged in an event, it should be nested under file.

This could be interpreted to apply when dealing with a TLS connection where only the server presents a certificate. The text here could be reworked to clarify when to use file vs tls.server/client.

[webmat]

Yes, that comment was for other kinds of events, like file events that also refer to a cert, like code signatures.

If it's a TLS, it should indeed be either tls.server or .client.