[TLS] Wire TLS encryption into the client Netty pipeline

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Description

Part of #3786 ([FIP-29: (m)TLS Support](https://cwiki.apache.org/confluence/spaces/FLUSS/pages/406620533/FIP-29+m+TLS+Support)).

**Wave 2** — depends on: SSL config & context foundations (#3796), server pipeline integration (#3792).

- `NettyClient` — builds a client `SslContext` once when `client.security.ssl.enabled=true`.
- `ServerConnection.establishConnection` — adds `SslHandler` at the pipeline head, configures hostname verification (`client.security.ssl.endpoint.identification.algorithm`, default `https`) using the target host/port.
- `TlsDataPathITCase` — end-to-end client↔server data-path test (append/scan) over TLS, verifying the zero-copy fallback path from #3792.

**Depends on:** SSL config & context foundations (#3796), server pipeline integration (#3792).

_Estimated diff size: ~330 lines._

### Willingness to contribute

- [x] I'm willing to submit a PR!

Read #3796 and #3792 first, then inspect NettyClient and ServerConnection.establishConnection to understand the available SSL context and server pipeline integration. Use TlsDataPathITCase as the entry point for the end-to-end append/scan behavior. Done means TLS client connections use hostname verification and the data-path test passes, including the zero-copy fallback path.

Written by the indexing model from the issue text.