Support configurable TLS client SNI validation and handle FQDNs …

[jfallows]

…with trailing dot

When a Kafka server hostname has a trailing dot, such as server.dev.local. then we implicitly pick this up as both the remote DNS name (for TCP) and the remote SNI Hostname (for TLS).

However, SNI Hostname does not support a trailing dot, and parts of the Java SSLEngine API remove it implicitly. Therefore, we need to also remove this implicitly when necessary in TLS client.

Note that DNS resolution considers server.dev.local. (absolute) and server.dev.local (relatve to . = root) as equivalent.

For example:

openssl s_client \
  -connect www.google.com.:443 \
  -servername www.google.com

and

openssl s_client \
  -connect www.google.com:443 \
  -servername www.google.com

both work correctly as expected.

This is because the server certificate has a CommonName of www.google.com in both cases.

If the server certifciate presents a CommonName with trailing dot, then TLS Hostname Verification must also be disabled by passing -Pzilla.binding.tls.client.https.identification=false to zilla start.