Fix #462: verify Thrift TLS server certificate by default [PECOBLR-3837][SEC-20280]

[msrathore-db]

Summary

Fixes #462. The Thrift HTTPS agent hardcoded rejectUnauthorized: false, which disabled server-certificate verification entirely on the primary Thrift transport. Any self-signed, expired, or wrong-hostname certificate was accepted, exposing the connection — including bearer-token auth headers — to man-in-the-middle attacks. Because verification was off, supplying a CA had no effect, so strict verification was not even possible on the Thrift path.

This PR makes the Thrift path secure-by-default (matching Node's https default, the JDBC/ODBC drivers, and the SEA/kernel backend) and adds SEA-parity public options on ConnectionOptions.

Changes

• HttpConnection.createHttpsAgent: rejectUnauthorized now defaults to true; only false when explicitly opted out.
• New public ConnectionOptions (SEA-parity naming):
  • checkServerCertificate (default true) → maps to the agent's rejectUnauthorized.
  • customCaCert → additive to the system trust store (appended to tls.rootCertificates), so trusting an internal/proxy CA does not drop the public roots and break normal Databricks warehouses.
  • clientCert / clientKey → client certificate + key for mutual TLS (mTLS).

Behavior

Config	Before	After
default	verification off (insecure)	verification on
bad/self-signed cert	silently accepted	rejected
checkServerCertificate: false	(only behavior)	explicit opt-out
customCaCert	ignored	trusted, additive to system roots
clientCert/clientKey	n/a	mTLS supported

Testing

• Unit tests (94 passing): default-verify-on, checkServerCertificate ↔ rejectUnauthorized, customCaCert additive, clientCert/clientKey mapping.
• Real warehouse (Azure SQL warehouse): default connects; a bogus CA is now rejected (proving verification is enforced); customCaCert with an unrelated CA added still connects (proving additive, not replacing); checkServerCertificate: false still connects.
• Hermetic mTLS: against a local server requiring client certs, the public clientCert/clientKey complete the handshake, while omitting them fails at the TLS layer.

Compatibility

Secure-by-default is a behavior change: environments relying on the old permissive default (self-signed/internal certs) must set checkServerCertificate: false or supply customCaCert. This matches Node/JDBC/ODBC/SEA behavior.

This pull request and its description were written by Isaac.

[github-actions]

Thanks for your contribution! To satisfy the DCO policy in our contributing guide every commit message must include a sign-off message. One or more of your commits is missing this message. You can reword previous commit messages with an interactive rebase (git rebase -i main).