[hongzhi-gao]

Description

Backport #18601 (commit 280c018) to rc/2.0.12, adding standard TLS and mutual TLS to the C/C++ tree/table clients and SessionPool. SSL settings are propagated through node discovery and reconnection. The backport includes the upstream OpenSSL build/package changes and plain/TLS/mTLS integration tests.

This PR also includes the fixes needed for issues exposed by release-branch CI:

• Resolve Homebrew's Boost header symlink to its own include root. Otherwise, the shared Homebrew include prefix exposes OpenSSL 4 headers to Thrift even when CMake selects the source-built OpenSSL 3.5.8 libraries.
• Run the ZH workflow through package, because distribution depends on server/CLI/ConfigNode ZIP artifacts attached during that phase. Test sources still compile with -DskipTests.
• Preserve extreme Python TIMESTAMP values under pandas 3.1.1. Existing exception paths retried an integer constructor that overflows at millisecond int64 boundaries. Construct from NumPy datetime64 with the original unit in those fallback paths. Normal conversions, existing timezone fallback and NaT behavior are preserved, and NumPy is already a dependency. This replaces the separate [2.0.12] Fix Python timestamp overflow with pandas 3.1 #19203; review all changes here.

The Python fix changes query-result conversion only; no storage format, WAL, RPC schema or server write-path changes are introduced.

Cherry-pick conflict

The sole conflict was the root pom.xml RAT exclusions. Keep the release branch's existing configuration and add only the TLS test fixture exclusions. Do not import the unrelated AINode notice exclusions from the source commit's context.

Validation

Executed locally:

• C++ Spotless and RAT checks with clang-format 17.0.6, plus root RAT: passed.
• mvn -o package -pl distribution -am -DskipTests -Ddevelocity.off=true: passed.
• CMake client builds with WITH_SSL=ON / BUILD_TESTING=ON and with WITH_SSL=OFF: passed. CMake install and standalone SDK example compilation also passed.
• run_cpp_it_phases.py against the release-branch standalone server: all 7 CTest suites passed (5 plain, 1 TLS, 1 mTLS), covering C/C++ tree/table APIs, SessionPool, discovery/failover and missing-client-certificate rejection. An initial run with 1G node memory exhausted the server's direct-memory budget; a complete rerun with a fresh distribution and 4G passed without assertion changes.
• Simulated a shared Boost prefix containing incompatible OpenSSL headers: the previous configuration failed in Thrift; the fixed configuration compiled and passed sessionUtilsTest and TLS/mTLS tests with both system OpenSSL 3.0.13 and source-built OpenSSL 3.5.8.
• New Python regression tests against the old implementation with pandas 3.1.1: 2 failed / 11 passed, reproducing positive and negative millisecond-boundary failures.
• python -m pytest iotdb-client/client-py/tests/unit -q with pandas 3.1.1: 47 passed, also rerun after combining the Python fix into this branch.
• python -m pytest iotdb-client/client-py/tests/unit/test_rpc_utils.py -q with pandas 2.3.3 and 3.0.5: 13 passed in each environment.
• From iotdb-client/client-py: python -m pytest tests/integration/test_treemodel_insert.py::test_insert_tablet tests/integration/test_tablemodel_query.py::test_query_data -q with pandas 3.1.1: 2 passed, one existing pandas warning about unit on a None input. Used the existing Docker fixture, the same release-branch server distribution, Ubuntu 24.04, JDK 17 and 4G node memory. A temporary local image used cached Ubuntu/JDK assets because the standard Focal image pull was unavailable; repository Dockerfiles and fixtures were unchanged.
• python -m black iotdb-client/client-py/ --check --diff and Python-module RAT: passed.
• git diff upstream/rc/2.0.12...HEAD --check: passed.

On the previous revision (14a952a), remote CI passed all five C++ platforms and ZH-Locale-Compile. Its Python failure (13 failed / 67 passed under pandas 3.1.1) is addressed by the Python fix now included here.

CI must rerun for the combined head; the previous revision's successes do not mean the combined head is all green. Windows/macOS checks and the full Python integration suite were not run locally. No performance improvement is claimed.