Improve TLS/SSL certificate error messages during handshake failures

[Aaronontheweb]

Summary

Resolves #7890 by providing human-readable, actionable error messages for TLS/SSL certificate validation failures.

Changes

Added TlsErrorMessageBuilder helper class (DotNettyTransportSettings.cs):

• Maps SslPolicyErrors to detailed explanations
• Interprets X509ChainStatusFlags with specific troubleshooting suggestions
• Provides role-specific guidance (client vs server)
• Comprehensive coverage of all certificate chain validation issues

Enhanced server-side mutual TLS validation (DotNettyTransport.cs):

• Upgraded from Warning to Error level for better visibility
• "No client certificate" scenario now includes detailed troubleshooting steps
• Certificate validation failures include full chain status diagnostics
• All errors log certificate details (subject, issuer, thumbprint, validity dates)

Enhanced TLS exception handling (TcpTransport.cs):

• Added detailed error messages to UserEventTriggered for TlsHandshakeCompletionEvent failures
• Enhanced ExceptionCaught to detect and report AuthenticationException and CryptographicException
• Client-side and server-side failures now have specific troubleshooting guidance

Updated test expectations:

• Clarified why certificate password errors cannot be improved (thrown by .NET Framework)
• Updated test comments to reflect enhanced error message behavior

Test Results

All existing TLS tests pass:

• ✓ DotNettyTlsHandshakeFailureSpec (2 tests)
• ✓ DotNettyMutualTlsSpec (6 tests)
• ✓ DotNettySslSupportSpec (9 tests)

Example Enhanced Error Output

Before:

[WARNING] Mutual TLS: Client certificate validation failed with errors: RemoteCertificateChainErrors

After:

[ERROR] Mutual TLS authentication failed: Client certificate validation error.
TLS/SSL certificate validation failed:
  - Certificate chain validation errors
    - UntrustedRoot: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
      Suggestion: Certificate chain terminates in an untrusted root. Install root CA certificate in Trusted Root Certification Authorities store.
    - PartialChain: A certificate chain could not be built to a trusted root authority.
      Suggestion: Certificate chain is incomplete. Install all intermediate CA certificates from your certificate provider.

Certificate Details:
  Subject: CN=akka-test-cert
  Issuer: CN=akka-test-cert
  Thumbprint: ABC123...
  Valid From: 2024-01-01 00:00:00
  Valid To: 2037-01-01 00:00:00
  Has Private Key: True

Benefits

• Faster troubleshooting of production TLS issues
• Reduced support burden from unclear certificate errors
• Better developer experience during certificate configuration
• Easier migration to mutual TLS with clear guidance on requirements