[TLS] Validate TLS config pass-through for the Flink connector

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Description

Part of #3786 ([FIP-29: (m)TLS Support](https://cwiki.apache.org/confluence/spaces/FLUSS/pages/406620533/FIP-29+m+TLS+Support)).

**Wave 2** — depends on: server pipeline integration (#3792).

Flink's catalog factory already forwards `client.security.*` options to the Fluss client generically — no connector code change is expected. Add `FlinkCatalogTlsITCase` proving this works end-to-end against a TLS-enabled cluster.

**Depends on:** server pipeline integration (#3792).

_Estimated diff size: ~120 lines._

_(Note: Spark coverage is split out into its own ticket for symmetry, since neither connector depends on the other.)_

### Willingness to contribute

- [x] I'm willing to submit a PR!

Start with the FlinkCatalogTlsITCase described in the issue and confirm the server pipeline integration in #3792 is available. Run the integration test against a TLS-enabled cluster, checking that client.security.* options pass through the Flink catalog factory and the end-to-end TLS connection succeeds.

Written by the indexing model from the issue text.