feat(kernel): richer TLS Go options — CA bundle + independent hostname skip

[mani-mathur-arch]

Context for reviewers

Part of the SEA-via-kernel backend for the Go driver: an alternative to the Thrift backend that talks to Databricks SQL through the Rust databricks-sql-kernel static library over a C ABI (built into the driver behind the databricks_kernel build tag; the default pure-Go build is unaffected). This PR adds two TLS knobs to that backend.

Stack position (each stacked on the one below):

#399  OAuth / namespace / metric-view / params / types / query-id   (base)
  └─ #400  richer TLS options            ← THIS PR
       └─ #401  kernel logging → driver log level
            └─ #402  nightly E2E workflow
                 └─ #403  CI dispatch label + CLOSE_STATEMENT telemetry

How to read the diff: the new public surface is the two With… options in connector.go + their config fields; the interesting logic is (a) the Thrift-path reject and (b) the OpenSession forwarding via the new cBytes cgo helper. Everything else is wiring + tests.

---

What

Exposes two kernel-only TLS options via an experimental-option idiom — no kernel change (both C-ABI setters already exist on kernel main, verified against the origin/main kernel header):

• WithKernelTrustedCerts(pem []byte) → kernel_session_config_set_tls_trusted_certs: adds a PEM CA bundle to the kernel's trust store on top of the system roots (corporate re-signing proxy / on-prem CA). Required rather than relying on SSL_CERT_FILE, which the kernel's rustls stack ignores.
• WithKernelSkipHostnameVerify() → kernel_session_config_set_tls_skip_hostname_verification: skips only the certificate hostname check while keeping chain validation (finer-grained than the blanket WithSkipTLSHostVerify).

Closes PECOBLR-3651.

Design

• Knobs live on a non-exported config.KernelExperimentalConfig off config.Config (NOT UserConfig), so they stay off the stable DSN/exported surface — same treatment as TLSConfig, mirroring Node's non-exported InternalConnectionOptions. DeepCopy copies the CA byte slice.
• The default (Thrift) backend rejects a non-nil block loudly at connect, so a caller who sets one and forgets WithUseKernel learns the option had no effect rather than connecting with a weaker-than-intended trust store.
• OpenSession forwards each to the kernel C ABI via a new byte-buffer helper (cBytes, mirroring cStr). A reflective guard (TestKernelExperimentalFieldsClassified) fails if a new experimental field isn't classified forwarded/rejected — so a future option can't silently be neither forwarded nor rejected.

Scope boundary (deliberately excluded, deferred)

Bundle 1b only (the no-kernel-dependency part of the richer-TLS work). The following were confirmed absent from kernel main, so they need a kernel C-ABI setter first and are correctly deferred:

• mTLS client cert/key (set_tls_client_certificate) → PECOBLR-3652 (K5).
• CloudFetch enable/disable (set_cloudfetch_enabled) → PECOBLR-3653 (K3).
• Private-key auth → PECOBLR-3605 (crate-blocked).

Testing

• Default CGO_ENABLED=0: build + vet + go test ./... — 24 pkg ok, 0 fail.
• Tagged CGO_ENABLED=1 -tags databricks_kernel (linked against a locally-built kernel .a): build + vet + test — 24 pkg ok, 0 fail. New TestSetKernelTLS drives the real cgo setters; untagged kernel_experimental_test.go covers the option→config wiring, the classification guard, and DeepCopy.
• Isaac Review: clean (0 critical / 0 major / 0 minor). Two info-level items were reviewed and judged harmless: the empty→nil []byte normalization, and the idempotent double hostname-skip call when both WithSkipTLSHostVerify + WithKernelSkipHostnameVerify are set.

Stacking / merge order

Stacked on #399 (mani/sea-kernel-consolidated). No KERNEL_REV change here (inherits #399's pin). #401 (kernel logging) is stacked on top of this.

This pull request and its description were written by Isaac.

[mani-mathur-arch]

Summary

Solid, focused PR — minor suggestions.

The experimental-option idiom (KernelExperimental off Config, WithKernel* prefix, fail-loud on Thrift) is the right design and consistent with the rest of the kernel backend work. cBytes / applyKernelTLS / trySetKernelTLS follow existing patterns well, and the reflective field-classification guard is a nice maintenance hook.

Main gap: no end-to-end test that Connect() actually rejects on the Thrift path (see inline on kernel_experimental_test.go). Everything else is polish / nice-to-have.