Support Spiffe provided certificates

## Enhancement

### Problem

TiDB's inbound MySQL listener currently loads its TLS certificate, private key, and CA material from PEM files. In SPIFFE/SPIRE deployments, X.509-SVIDs are delivered and rotated through the SPIFFE Workload API.

Using these identities with TiDB currently requires an external process to copy them into PEM files and execute `ALTER INSTANCE RELOAD TLS` after each rotation.

### Proposed behavior

Add opt-in [SPIFFE Workload API](https://spiffe.io/docs/latest/spiffe-specs/spiffe_workload_endpoint/) support for inbound MySQL TLS:

- Connect to an explicitly configured Unix domain socket.
- Use the default X.509-SVID as the server certificate.
- Trust all local and federated X.509 bundles returned by the Workload API.
- Apply valid certificate and bundle rotations automatically to new TLS connections.
- Leave existing connections unchanged during rotation.
- Retain the last valid TLS material during malformed updates or temporary socket outages.
- Fail startup if no valid initial X.509 context is available within the configured timeout.
- Require every presented client certificate to be a valid SPIFFE X.509-SVID.
- Use the SPIFFE URI SAN as the authoritative workload identity.

### Compatibility and scope

- SPIFFE mode applies only to the inbound MySQL listener.
- Cluster TLS remains file-based.
- SPIFFE mode is mutually exclusive with MySQL `ssl-ca`, `ssl-cert`, `ssl-key`, and `auto-tls`.
- Both forms of `ALTER INSTANCE RELOAD TLS` should remain successful no-ops in SPIFFE mode.
- The Workload API endpoint must be explicitly configured; TiDB should not inspect `SPIFFE_ENDPOINT_SOCKET`.
- TCP Workload API endpoints and DNS `VERIFY_IDENTITY` compatibility are out of scope.

Start by tracing the inbound MySQL listener's existing PEM TLS loading, ALTER INSTANCE RELOAD TLS handling, and configuration validation; the payload names no source files or tests. Done means opt-in Unix-socket SPIFFE support handles initial loading, rotation, invalid updates, client identity checks, and compatibility rules without changing cluster TLS.

Written by the indexing model from the issue text.