[TLS] Validate TLS config pass-through for the Spark connector

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Description

Part of #3786 ([FIP-29: (m)TLS Support](https://cwiki.apache.org/confluence/spaces/FLUSS/pages/406620533/FIP-29+m+TLS+Support)).

**Wave 2** — depends on: server pipeline integration (#3792).

Spark's catalog already forwards all catalog options to the Fluss client generically — no connector code change is expected. Add `SparkCatalogTlsTest` proving this works end-to-end against a TLS-enabled cluster.

**Depends on:** server pipeline integration (#3792).

_Estimated diff size: ~95 lines._

_(Companion to the Flink connector ticket, #3794 — neither depends on the other.)_

### Willingness to contribute

- [x] I'm willing to submit a PR!

Start by locating the Spark catalog connector tests and add the named SparkCatalogTlsTest, then run the relevant setup against a TLS-enabled cluster. Done means an end-to-end test proves catalog options reach the Fluss client and TLS configuration works; this depends on server pipeline integration #3792.

Written by the indexing model from the issue text.