fix(zookeeper): Enable client certificate hostname verification

[NickLarsenNZ]

tl;dr: Before ZK 3.9.6, there was no client certificate hostname validation in FIPS mode (default). Now there is, but it only seems to validate IPs, not hostnames.

This PR adds a patch to defers to the ZKTrustManager for client certificate hostname validation (which is already used by the non-FIPS path.

Warning

I'm unsure if doing this breaks some kind of FIPS contract.
I'm also unsure if there is some kind of toggle for SunJSSE implementation which does enable client certificate hostname validation. So far I don't think there is.

---

Before, with the enabled test in FIPS mode, we see it fail with:

mvn -pl zookeeper-server test -Dtest='QuorumSSLTest#testHostnameVerificationWithInvalidIpAddressAndValidHostname' -Dcheckstyle.skip -Dspotbugs.skip -Drat.skip -Dsurefire.useFile=false

[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.zookeeper.server.quorum.QuorumSSLTest
[ERROR] Tests run: 2, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 42.159 s <<< FAILURE! - in org.apache.zookeeper.server.quorum.QuorumSSLTest
[ERROR] testHostnameVerificationWithInvalidIpAddressAndValidHostname{boolean}[2]  Time elapsed: 33.019 s  <<< FAILURE!
org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
        at org.apache.zookeeper.server.quorum.QuorumSSLTest.testHostnameVerification(QuorumSSLTest.java:786)
        at org.apache.zookeeper.server.quorum.QuorumSSLTest.testHostnameVerificationWithInvalidIpAddressAndValidHostname(QuorumSSLTest.java:719)

[INFO] 
[INFO] Results:
[INFO] 
[ERROR] Failures: 
[ERROR]   QuorumSSLTest.testHostnameVerificationWithInvalidIpAddressAndValidHostname:719->testHostnameVerification:786 expected: <true> but was: <false>
[INFO] 
[ERROR] Tests run: 2, Failures: 1, Errors: 0, Skipped: 0
[INFO] 
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  58.736 s
[INFO] Finished at: 2026-09-18T15:09:45+02:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:2.22.1:test (default-test) on project zookeeper: There are test failures.

[NickLarsenNZ]

@lfrancke, I think we should raise an upstream issue for this.
Maybe there was some reason they don't want to use ZKTustManager (I don't understand why there is a split).

[NickLarsenNZ]

This is not actually the fix.
It technically works, but probably only when the JDK isn't running FIPS mode (although that appears to be gone anyway, so it's hard to say what would happen if someone needed to run a FIPS TrustManager like BouncyCastle's.

Closing in favour of disabling client cert hostname validation for quorums, until ZOOKEEPER-5096 is fixed.