set global require_secure_transport=on invalid

## Bug Report

### 1. Minimal reproduce step (Required)

Deploy a new cluster and correctly configure the tidb security TLS config

server_config:
tidb:
security.ssl-ca: /data/tidb-deploy/711/tidb-4001/conf/ca.pem
security.ssl-cert: /data/tidb-deploy/711/tidb-4001/conf/tidb-server.pem
security.ssl-key: /data/tidb-deploy/711/tidb-4001/conf/tidb-server-key.pem

Then, establish a new session to connect to the database and enable the 'require_secure_transport' variables.

### 2. What did you expect to see? (Required)

The new session failed to log in with the command "mysql -u -h -P -p" due to an error: "ERROR 3159 (HY000): Connections using insecure transport are prohibited while --require_secure_transport=ON."

`[tidb@vm10-2-106-186 conf]$ mysql -uroot -h10.2.106.186 -P4001 -p
Enter password:
ERROR 3159 (HY000): Connections using insecure transport are prohibited while --require_secure_transport=ON.`

### 3. What did you see instead (Required)

The new session successfully logged in using the command "mysql -u -h -P -p".

`vera@veradeMacBook-Air test % mysql --comments --host 10.2.106.186 --port 4001 -u root
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 1279262724
Server version: 8.0.11-TiDB-v8.5.1 TiDB Server (Apache License 2.0) Community Edition, MySQL 8.0 compatible

Copyright (c) 2000, 2026, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show variables like '%require%';
+--------------------------+-------+
| Variable_name | Value |
+--------------------------+-------+
| require_secure_transport | ON |
| sql_require_primary_key | OFF |
+--------------------------+-------+
2 rows in set (0.03 sec)

mysql> exit
Bye`

The changes can only take effect by executing "ALTER INSTANCE RELOAD TLS" or "reload tidb".This is typically executed only when updating TLS certificates. Inconsistencies in behavior before and after the certificate update can easily cause a large number of business errors.

### 4. What is your TiDB version? (Required)

[tidb@vm10-2-106-186 bin]$ ./tidb-server -V
Release Version: v8.5.1
Edition: Community
Git Commit Hash: fea86c8e35ad4a86a5e1160701f99493c2ee547c
Git Branch: HEAD
UTC Build Time: 2025-01-16 07:38:34
GoVersion: go1.23.4
Race Enabled: false
Check Table Before Drop: false
Store: unistore

Reproduce the behavior by setting require_secure_transport with the TLS configuration shown, then compare connection handling before and after ALTER INSTANCE RELOAD TLS or reload tidb. Trace the entry points for the global variable and TLS reload behavior; done means insecure new sessions are consistently rejected without requiring a certificate reload.

Written by the indexing model from the issue text.