[TLS] Add certificate hot-reload and TLS metrics

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Description

Part of #3786 ([FIP-29: (m)TLS Support](https://cwiki.apache.org/confluence/spaces/FLUSS/pages/406620533/FIP-29+m+TLS+Support)).

**Wave 2** — depends on: SSL config & context foundations (#3796), server pipeline integration (#3792).

Certificates rotate; add hot-reload so a process restart isn't required to pick up renewed key material.

- `SslContextProvider` — indirection in front of the `SslContext`; background task on `security.ssl.reload.interval` (default 5 min, `0` disables) rebuilds the context when key material changes; atomic single volatile-reference swap; keeps the last-known-good context and logs a WARN on a failed rebuild.
- Change detection resolves symlinks (`Path.toRealPath()`), so it catches the Kubernetes/cert-manager `..data` symlink-swap pattern, not just in-place rewrites.
- Reactive/self-healing reload: force-reload before a handshake if the certificate is expired/near-expiry, and after a handshake failure consistent with stale material when the on-disk file has changed — both triggers share one hard-coded rate limit.
- Near-expiry WARN logging (default 7-day threshold), independent of whether polling is enabled.
- New metrics: `tls.handshake.failures` (counter, per listener), `tls.certificate.days.to.expiry` (gauge, per listener).

**Depends on:** SSL config & context foundations (#3796), server pipeline integration (#3792).

_Estimated diff size: ~585 lines._

### Willingness to contribute

- [x] I'm willing to submit a PR!

Start by reading the SSL config and context foundations in #3796 and server pipeline integration in #3792, then trace the planned SslContextProvider entry point. Define completion against the stated reload, symlink detection, self-healing, near-expiry logging, and per-listener metrics requirements, including the default interval and threshold behavior.

Written by the indexing model from the issue text.