Refactor TLS SSL context configuration

[Copilot]

Closes #3461.

TLS connections configured both SSL_CTX and SSL directly, even though SSL inherits connection options from its context. This refactors setup so each connection’s SSL_CTX is fully configured before creating the per-connection SSL.

• Context-first TLS setup

  • Delay SSL creation until after certificate, verification, and ALPN configuration is applied to SSL_CTX.
  • Keep connection-specific setup, such as SNI, on SSL.

• Clear certificate configuration phases

  • Split certificate application into explicit context and connection phases:

    cert->configure_context(cfg);
    create_ssl();
    cert->configure_connection(get_ssl());

• Safer OpenSSL handling

  • Add checks for touched OpenSSL calls and allocations.
  • Use RAII during BIO setup until ownership is transferred to OpenSSL.

• Focused coverage

  • Add a TLS unit test confirming verification mode is inherited by the created SSL connection.

[achamayou]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts in commit 766754b2b. Targeted validation passed with cmake --build build --target tls_test and ./build/tls_test.