feat(transport/channel): expose ServerCertVerifier API

[YutaoMa]

Motivation

Ref: #2444

tonic::transport::ClientTlsConfig currently builds the rustls::ClientConfig internally with the default WebPkiServerVerifier. There's no way to inject a custom ServerCertVerifier without abandoning ClientTlsConfig and going through Endpoint::connect_with_connector_lazy, which means reimplementing TCP + TLS handshake + ALPN enforcement + timeout handling that tonic already provides correctly.

This blocks gRFC A29 (xDS-Based TLS Security) SAN matching feature which we are adding to tonic-xds.

Solution

Adds Endpoint::tls_config_with_verifier(ClientTlsConfig, Arc<dyn ServerCertVerifier>). When invoked, TlsConnector::new builds the ClientConfig via .dangerous().with_custom_certificate_verifier(...) instead of the default root-store path. SNI, ALPN, timeout, identity, and key-log continue to apply.

Design Highlights

• API placement on Endpoint rather than ClientTlsConfig: Adding the verifier as a field on ClientTlsConfig would require storing Arc<dyn ServerCertVerifier>. Since the ServerCertVerifier trait carries no UnwindSafe + RefUnwindSafe bounds, the dyn type does not propagate either auto trait, which would silently strip ClientTlsConfig's existing UnwindSafe + RefUnwindSafe impls — a semver-breaking auto-trait removal flagged by cargo-semver-checks. Placing the method on Endpoint (which is already !UnwindSafe) avoids the regression and keeps the verifier opt-in, scoped to users who explicitly need it.

• Conflict detection: combining a custom verifier with ca_certificate, ca_certificates, trust_anchor, trust_anchors, with_*_roots returns TlsError::VerifierConflict at connector-construction time. A custom verifier replaces the entire default-verifier path including its trust roots, so the CA-configuration methods would be silently ignored. We chose to emit an explicit error to help prevent such footguns. Users who want both standard WebPKI behavior and additional checks can compose WebPkiServerVerifier inside their custom verifier with their own root store (as is planned for tonic-xds A29 implementation).