Allow configuration to disable SNI Host checking (defaulted to enabled)

[capistrant]

Description

Some testing of the upcoming release of Druid 35 uncovered a potential breaking change in the release. #18424 upgraded from jetty 9.x to 12.x. One change in this upgrade appears to be how SNI Host checking is handled by Jetty servers. In Jetty9, if there was one certificate in the keystore, SNI Host check was actually skipped by the server. This skip is no longer happening, so situations like trying to connect with localhost that used to work, will now get a 400 response from the server. Overall this change is reasonable by the jetty team, but to allow for some wiggle-room for operators in the Druid 35 upgrade, we have decided to make SNI Host checking by jetty servers opt-out. This means by default, when you upgrade your cluster (if using TLS) will perform strict SNI host checks. If you choose to opt out, you should do so with caution and with a plan to get back to the default config.

Release note

this should be a part of the jetty12 section of the notes

Jetty 12 servers now do strict SNI Host checks when TLS is enabled. If the host your client is connecting to the server with does not match what is in the keystore, even if there is only one certificate in that keystore, it will return a 400 response. This could impact some use cases, such as folks connecting over localhost for whatever reason. If this change will break your deployment, you can opt-out of the change by setting druid.server.http.enforceStrictSNIHostChecking to false in the runtime.properties for some or all of your Druid services. It is recommended that you modify your client behavior to accommodate this change in jetty instead of overriding the config whenever possible.

---

Key changed/added classes in this PR

• ServerConfig
• JettyServerModule

---

This PR has:

• been self-reviewed.
• added documentation for new or modified features or behaviors.
• a release note entry in the PR description.
• added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
• added or updated version, license, or notice information in licenses.yaml
• added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
• added unit tests or modified existing tests to cover new code paths, ensuring the threshold for code coverage is met.
• added integration tests.
• been tested in a test Druid cluster.