[Pipe] Prevent unexpected OPC UA endpoint redirects

[Caideyipi]

Description

Problem

Outbound OPC UA client

The Eclipse Milo client discovers endpoints from the configured OPC UA server and then connects to the endpoint URL advertised by the server. If the advertised hostname differs from node-url and resolves to another machine, Pipe can silently send data to the wrong OPC UA server.

Readers of the internal OPC UA server

The internal server binds to 0.0.0.0 and, by default, publishes its detected hostname and local interface addresses. Milo filters GetEndpoints by the requested host only when that host exactly matches a published endpoint. When a reader reaches the server through NAT, a VIP, a container mapping, a load balancer, or a DNS alias, the host may not match. The server then returns all local endpoints, and a reading or subscribing client may reconnect to a colliding hostname and read from the wrong internal server.

Pipe writes directly into the internal server namespace, so it does not have the outbound writer problem. External browse, read, and subscription clients still follow endpoint discovery, so the advertised-host handling from opc_server commit 78dc20ec15fff4b29ce2a3aa291fcdc521260a4b is ported here for the reader side.

Behavior

Outbound client

• Add connector.opcua.allow-endpoint-redirect and its sink.opcua.allow-endpoint-redirect alias.
• Keep endpoint redirects disabled by default: use the host and port from the configured node-url, while preserving the advertised endpoint path, security settings, certificate, and token policies.
• When the option is true, preserve Milo's existing behavior and use the complete advertised endpoint URL.
• Match the configured URL scheme and transport profile before selecting an endpoint.
• Log the configured, advertised, and effective endpoint URLs.
• Include the option in shared OPC UA client conflict detection.

Internal server

• Add connector.opcua.advertised-host and its sink.opcua.advertised-host alias.
• When configured, publish only that hostname or IP address in endpoint discovery while continuing to bind to 0.0.0.0.
• Preserve the existing automatic local hostname/address discovery when the option is absent.
• Accept hostnames and IPv4/IPv6 addresses, including bracketed IPv6 input, and reject values containing a scheme, port, or path.
• Include the advertised host in newly generated OPC UA and HTTPS certificate subject alternative names.
• Warn when an existing OPC UA certificate does not contain the configured advertised host, because secured clients may require certificate replacement/regeneration and renewed trust.
• Include the advertised host in shared internal-server conflict detection.

Tests

• ClientRunnerTest: configured host/port override, opt-in redirect, scheme/transport selection, and shared-client conflict detection.
• OpcUaServerBuilderTest: default endpoint publication, explicit advertised host, IPv6/input validation, certificate SAN generation, and shared-server conflict detection.
• mvn spotless:apply -pl iotdb-core/node-commons,iotdb-core/datanode -DskipTests
• Targeted node-commons + datanode reactor tests: 9 tests, 0 failures
• mvn test-compile -pl iotdb-core/node-commons,iotdb-core/datanode -P with-zh-locale -DskipTests

---

This PR has:

• been self-reviewed.
• added comments explaining the why and intent where the behavior is not obvious.
• added unit tests to cover the new code paths.

---

Key changed/added classes (or packages if there are too many classes) in this PR

• OpcUaSink
• ClientRunner
• OpcUaServerBuilder
• OpcUaKeyStoreLoader
• ClientRunnerTest
• OpcUaServerBuilderTest