cli: `~/.cockcroach-certs` incorrectly takes precedence over `--url`

**Describe the problem**

When `~/.cockroach-certs` exists and contains certs with the right username, these will be used by `cockroach sql` even if it is used with a `--url` parameter which explicitly specifies `sslkey` and `sslcert` locations.

**To Reproduce**

What did you do? Describe in your own words.

I originally discovered this while running a roachtest in local mode while `~/.cockroach-certs` existed with certs for my serverless cloud cluster.

If possible, provide steps to reproduce the behavior:

1. Create a full set of certificates (ca, node, client.root) in `~/.cockroach-certs`
2. Create a second full set of certificates in a different directory (e.g. `./certs`)
3. Start a cockroach node with the second set of certs: `cockroach start-single-node --certs-dir=./certs`
4. Attempt to connect with `cockroach sql --url=postgresql://root@localhost:26257/?sslcert=.%2Fcerts%2Fclient.root.crt&sslkey=.%2Fcerts%2Fclient.root.key&sslrootcert=.%2Fcerts%2Fca.crt&sslmode=verify-full`

This fails with the message `failed to connect to `host=localhost user=root database=`: failed to receive message (remote error: tls: unknown certificate authority)`. The message `"E240325 15:42:12.611348 1080 1@server/server_sql.go:1872 ⋮ [T1,Vsystem,n1,client=‹[::1]:51077›] 113 serving SQL client conn: ‹tls: failed to verify certificate›: ‹x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error"` is seen in the server logs.

**Expected behavior**

The login should succeed. It does succeed with `psql` given the same url, and with `cockroach sql --certs-dir=./certs`.

**Additional data / screenshots**

Logging the url at the beginning of https://github.com/cockroachdb/cockroach/blob/215ece44cfba2ab950570f9d03cf29599e1ad088/pkg/cli/clisqlcfg/context.go#L152 shows that it has been rewritten with different `sslkey` and `sslcert` values that point to `~/.cockroach-certs` (the `sslrootcert` parameter is unchanged).

I initially suspected the `AnalyzeClientURL` function but logging at https://github.com/cockroachdb/cockroach/blob/215ece44cfba2ab950570f9d03cf29599e1ad088/pkg/cli/clienturl/client_url.go#L123 revealed that it is not responsible.

My current suspicion is that this function is not looking at the entire CLI configuration: https://github.com/cockroachdb/cockroach/blob/215ece44cfba2ab950570f9d03cf29599e1ad088/pkg/cli/client_url.go#L21

It also looks incorrect that we set a URL parsing function *after* creating a connection in https://github.com/cockroachdb/cockroach/blob/215ece44cfba2ab950570f9d03cf29599e1ad088/pkg/cli/sql_shell_cmd.go#L57-L64

**Environment:**
- CockroachDB version: recent `master` (commit c994982a)
- Server OS: macOS
- Client app: `cockroach sql`

**Additional context**
What was the impact?

I spent a long time trying to troubleshoot this mysterious behavior while trying to write a roachtest. Now I've renamed my `~/.cockroach-certs` directory and am unblocked.

Jira issue: CRDB-37068