clickhouse-go trying turn on X-ClickHouse-SSL-Certificate-Auth every time when connect with user without password

## Observed

try connect into clickhouse/clickhouse-server:25.7 with `default` user and empty passsword via HTTPS

## Expected behaviour
Successful authorization without trying to using SSL Cert as authorization method

## Code example

```go
package main

import (
"context"
"crypto/tls"
"fmt"
"github.com/ClickHouse/clickhouse-go/v2"
"time"
)

func main() {
fmt.Println(connect())
}

func connect() error {
conn, openErr := clickhouse.Open(&clickhouse.Options{
Addr: []string{"localhost:8443"},
Auth: clickhouse.Auth{
Database: "default",
Username: "default",
Password: "",
},
Debug: true,
TLS: &tls.Config{
InsecureSkipVerify: true,
},
Protocol: clickhouse.HTTP,
DialTimeout: time.Second * 10,
MaxOpenConns: 10,
MaxIdleConns: 5,
ConnMaxLifetime: time.Hour,
})

if openErr != nil {
return fmt.Errorf("openErr=%w", openErr)
}

if pingErr := conn.Ping(context.Background()); pingErr != nil {
return fmt.Errorf("pingErr=%w", pingErr)
}

return nil
}
```

## Error log

```log
[clickhouse-http][localhost:8443][id=1][query hello]
[clickhouse-http][localhost:8443][id=1][http query] "SELECT displayName(), version(), revision(), timezone()"
pingErr=failed to query server hello: failed to query server hello info: sendQuery: [HTTP 403] response body: "Code: 516. DB::Exception: Invalid authentication: SSL certificate authentication requires nonempty certificate's Common Name or Subject Alternative Name. (AUTHENTICATION_FAILED) (version 25.7.1.3997 (official build))
"

2025.08.04 07:26:57.384254 [ 85 ] {} DynamicQueryHandler: Code: 516. DB::Exception: Invalid authentication: SSL certificate authentication requires nonempty certificate's Common Name or Subject Alternative Name. (AUTHENTICATION_FAILED), Stack trace (when copying this message, always include the lines below):

0. DB::Exception::Exception(DB::Exception::MessageMasked&&, int, bool) @ 0x00000000127c721b
1. DB::Exception::Exception(PreformattedMessage&&, int) @ 0x000000000bfd62cc
2. DB::Exception::Exception<>(int, FormatStringHelperImpl<>) @ 0x000000000bfe268b
3. DB::authenticateUserByHTTP(DB::HTTPServerRequest const&, DB::HTMLForm const&, DB::HTTPServerResponse&, DB::Session&, std::unique_ptr>&, DB::HTTPHandlerConnectionConfig const&, std::shared_ptr, std::shared_ptr) @ 0x00000000185575d4
4. DB::HTTPHandler::authenticateUser(DB::HTTPServerRequest&, DB::HTMLForm&, DB::HTTPServerResponse&) @ 0x0000000018487d50
5. DB::HTTPHandler::processQuery(DB::HTTPServerRequest&, DB::HTMLForm&, DB::HTTPServerResponse&, DB::HTTPHandler::Output&, std::optional&, StrongTypedef const&) @ 0x0000000018488212
6. DB::HTTPHandler::handleRequest(DB::HTTPServerRequest&, DB::HTTPServerResponse&, StrongTypedef const&) @ 0x0000000018490be4
7. DB::HTTPServerConnection::run() @ 0x000000001854c740
8. Poco::Net::TCPServerConnection::start() @ 0x000000001d89cb27
9. Poco::Net::TCPServerDispatcher::run() @ 0x000000001d89cf79
10. Poco::PooledThread::run() @ 0x000000001d868207
11. Poco::ThreadImpl::runnableEntry(void*) @ 0x000000001d8667a1
12. ? @ 0x0000000000094ac3
13. ? @ 0x0000000000125a04
(version 25.7.1.3997 (official build))
```

## Details

### Environment
* [x] `clickhouse-go` version: v2.40.1
* [x] Interface: `database/sql` compatible driver
* [x] Go version: 1.24.5
* [x] Operating system: Ubuntu
* [x] ClickHouse version:
* [x] ClickHouse Server non-default settings, if any:
/etc/clickhouse-server/config.d/https_port.xml
```xml

8443


/etc/clickhouse-server/server.crt
/etc/clickhouse-server/server.key
none

```

I propose suggestion to add option which explicilty turn on `X-ClickHouse-SSL-Certificate-Auth: on` header, instead of use it every time when trying connect with user without password

Start at the clickhouse.Open and conn.Ping flow in the provided Go example, then trace how HTTPS requests decide whether to send X-ClickHouse-SSL-Certificate-Auth. Reproduce the connection against ClickHouse 25.7 with an empty password and inspect the existing HTTP authentication tests or entry points. Done means empty-password HTTPS authentication succeeds without certificate authentication unless explicitly enabled.

Written by the indexing model from the issue text.