fix(tls): validate public certificate SANs - #220

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Closes rustfs/backlog#1086

Summary of Changes

• Centralize the server-certificate SAN validation policy in a helper that depends only on requireSanMatch.
• Keep public HTTPS certificate validation active when enableInternodeHttps=false.
• Add a regression test that rejects a mismatched public DNS SAN with internode HTTPS disabled.

The original gate coupled SAN validation to internode HTTPS. Later TLS work removed that coupling in the main path, but the exact public-only behavior was not locked by a regression test. This change makes the policy boundary explicit and prevents the original issue from returning during future TLS refactors.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (N/A: no user-facing contract change)
• CHANGELOG.md updated under [Unreleased] (N/A: this repository does not contain CHANGELOG.md)
• CI/CD passed (pending)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: public TLS configurations retain SAN enforcement independently of internode transport settings.

Verification

cargo test require_san_match_validates_public_tls_when_internode_https_is_disabled
make pre-commit

Additional Notes

The change does not enable internode HTTPS or alter generated SAN sets. It only makes the existing requireSanMatch policy independent and regression-tested.

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.