fix(network): harden TLS and DTLS security configuration

[mbuckton]

Summary

• load DTLS endpoints from security.dtls and TLS endpoints from security.tls
• preserve configured DTLS client-certificate requirements
• expose peer certificate identities for required and requested TLS/DTLS authentication
• verify outbound TLS hostnames by default, with hostnameVerificationEnabled as an explicit opt-out
• apply nested TLS/DTLS settings during dynamic updates and update stored endpoint state
• serialize context, CRL, hostname, and key/trust-store settings consistently
• add focused configuration, DTLS, update-path, and outbound-engine regression tests

Companion change

SSL engine and CRL trust-manager fixes: Maps-Messaging/authentication_library#464

Verification

Focused JUnit tests were added for profile selection, nested updates, stored-state updates, DTLS client-auth preservation, and hostname verification. The available GitHub Maven workflow is running against the branch; no full local build is available in this managed environment.

SECURITY: TLS and DTLS transport hardening

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3df92972-7f72-4208-9f55-6aac7aee5bb1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}