Preserve configured client hostname verification with Netty 4.2

[xiangfu0]

Netty 4.2 defaults client builders to HTTPS endpoint identification. ZooKeeper’s existing trust-manager/engine policy honors zookeeper.ssl.hostnameVerification, but the new builder default rejects a trusted mismatched SAN even when that setting is false.

Clear only the client builder’s endpoint-identification default, leaving the existing configured ZooKeeper verifier and server mutual-TLS policy in control. Extend the existing DNS/IP × FIPS mismatch cases to test both enabled and disabled hostname verification. The call also compiles with the current Netty 4.1.138 pin; this PR does not upgrade Netty.

How to reproduce

Run SSLHostnameVerificationTest#testClientHostnameVerificationWithMismatchNames with runtime Netty 4.2.19. Before the production fix, all four hostnameVerification=false cases fail; the four enabled-policy cases retain rejection. With the fix, all eight pass.

Using a Maven wrapper against this checkout after compiling/installing its source at the normal pin:

/path/to/mvnw -f pom.xml -pl zookeeper-server -Dnetty.version=4.2.19.Final \
  -Dsurefire-forkcount=1 \
  -Dtest=SSLHostnameVerificationTest#testClientHostnameVerificationWithMismatchNames \
  dependency:properties surefire:test

Repeat with -Dzookeeper.ssl.sslProvider=OPENSSL for the native provider.

Validation

• JDK 25: patched real client/server mismatch matrix passes 8/8 with JDK TLS and 8/8 with Netty tcnative BoringSSL/OpenSSL. Unmodified production-source controls fail exactly the four disabled-policy cases for each provider. Session and hostname-verification exception logs corroborate the outcomes.
• All 12 existing ClientSSLTest positive provider/FIPS/policy cases pass at runtime Netty 4.2.19, including matching-name verification and create/delete operations on three server sessions.
• Restored patch compiles at the normal Netty 4.1.138 pin; Checkstyle reports zero violations and the diff check passes.
• Broader selected ClientSSLTest runs retain existing negative-assertion failures at parameter cases [2]/[4], also reproduced on unmodified production source (that control additionally failed [6]). No expectation was changed or test disabled; full upstream CI has not been certified.

This is a master fix. The released 3.9.6 client used by apache/pinot#19828 remains affected; a release-line fix and published artifact are separate prerequisites before that consumer can claim compatibility.