[TLS] Wire TLS encryption into the client Netty pipeline

[affo]

Search before asking

• I searched in the issues and found nothing similar.

Description

Part of #3786 (FIP-29: (m)TLS Support).

Wave 2 — depends on: SSL config & context foundations (#3796), server pipeline integration (#3792).

• NettyClient — builds a client SslContext once when client.security.ssl.enabled=true.
• ServerConnection.establishConnection — adds SslHandler at the pipeline head, configures hostname verification (client.security.ssl.endpoint.identification.algorithm, default https) using the target host/port.
• TlsDataPathITCase — end-to-end client↔server data-path test (append/scan) over TLS, verifying the zero-copy fallback path from [TLS] Wire TLS encryption into the server Netty pipeline #3792.

Depends on: SSL config & context foundations (#3796), server pipeline integration (#3792).

Estimated diff size: ~330 lines.

Willingness to contribute

• I'm willing to submit a PR!