Feature Request: JDBC Connection Properties to Override Control Plane API Endpoints for IAM Authentication

## Context

When connecting to Redshift through a **private VPC endpoint** using IAM authentication (`jdbc:redshift:iam://`), the driver makes two separate network calls:

**Data plane — works correctly**
```
Driver → cluster/workgroup VPC endpoint (TCP/5439 or TCP/5453)
```

**Control plane — no override available**
```
Driver → redshift..amazonaws.com:443 (provisioned)
Driver → redshift-serverless..amazonaws.com:443 (serverless)
```

The data plane routes privately through the VPC endpoint. The control plane has no equivalent — it always hits the public regional API endpoint with no way to override it.

---

## Problem

In a private network environment (Direct Connect / VPN, no public internet), the control plane call times out:

```
IAM error retrieving temp credentials:
Unable to execute HTTP request:
Connect to redshift.ca-central-1.amazonaws.com:443 timed out
```

The driver already exposes `StsEndpointUrl` to override the STS endpoint. There is no equivalent property for the Redshift or Redshift Serverless control plane endpoints.

---

## Proposed Properties

Following the same pattern as the existing `StsEndpointUrl`:

| Property | Overrides | Deployment |
|---|---|---|
| `StsEndpointUrl` | `sts..amazonaws.com` | Both — already exists |
| `RedshiftEndpointUrl` | `redshift..amazonaws.com` | Provisioned — **proposed** |
| `RedshiftServerlessEndpointUrl` | `redshift-serverless..amazonaws.com` | Serverless — **proposed** |

### Usage

```java
// Provisioned
ds.addConnectionProperty("RedshiftEndpointUrl",
"https://vpce-xxxx.redshift.ca-central-1.vpce.amazonaws.com");

// Serverless
ds.addConnectionProperty("RedshiftServerlessEndpointUrl",
"https://vpce-xxxx.redshift-serverless.ca-central-1.vpce.amazonaws.com");
```

When not set — default behaviour unchanged.

---

## Additional Note — Serverless

For Serverless, pre-fetching credentials via `RedshiftServerlessClient.getCredentials()` and passing the resulting `IAMR:`-prefixed username outside the `iam:` scheme is not viable — the driver rejects it with `FATAL: IAM authentication failed`. The `iam:` scheme and driver-internal `GetCredentials` call are mandatory for Serverless, making the endpoint override the only feasible code-level solution.

---

Locate the existing StsEndpointUrl connection-property handling and the driver-internal IAM GetCredentials calls for provisioned and serverless Redshift. Add corresponding endpoint properties while preserving the existing defaults, then verify IAM authentication works through private endpoints for both deployments.

Written by the indexing model from the issue text.