[Feature Request] Support TLS certificate fingerprint pinning

## Is your feature request related to a problem?

Yes.

`grpcurl` currently supports standard TLS certificate validation through
`-cacert`, as well as disabling verification with `-insecure`. However, it
does not provide a way to pin the server certificate or public key by its
SHA-256 fingerprint.

This is useful when:

- the client must connect only to a specific server certificate;
- the environment does not have a trusted public CA;
- the caller wants protection against an unexpected certificate or CA;
- grpcurl is used in automated scripts or diagnostic environments where
certificate pinning is required.

Using `-cacert` is not equivalent to fingerprint pinning because it validates
the certificate chain but does not require the peer certificate to match a
specific fingerprint.

## Proposed solution

Add an option that verifies the server certificate fingerprint after the TLS
connection is established.

For example:

```bash
grpcurl \\
-cert-fingerprint sha256:0123456789abcdef... \\
api.example.com:443 \\
list

Start by locating where grpcurl defines the -cacert and -insecure TLS options, then trace how the connection is established. Decide how the proposed -cert-fingerprint value should represent certificate versus public-key pinning, and add coverage for matching and non-matching SHA-256 fingerprints. Done means the CLI accepts the option and rejects a server that does not match it.

Written by the indexing model from the issue text.