Add verified SSL connections and ARM regression gate

[skhe]

Summary

• Support verified DM8 SSL connections through ssl_path and reject a plain-server negotiation when SSL is requested.
• Validate modern certificates with CA and hostname; pin the exact bundled legacy server certificate when it has no SAN.
• Add an isolated ARM Linux SSL CI job and four real-database SSL checks.

Verification

• SSL suite on the exact pinned ARM CI image: 4 passed.
• Full GB18030 real-database suite: 188 passed, 6 deselected.
• Vendored Go driver tests and actionlint: passed.

Scope

ssl_pwd and UKey remain unsupported. A modern SAN certificate still needs end-to-end validation on a corresponding DM8 server.