[FLINK-38953] Cleanup configurations for SSL hostname verification

[mateczagany]

What is the purpose of the change

As described in this ML thread, the SSL endpoint verification configuration is not working as expected. This was mitigated in #27407 but the change in that PR enables endpoint verification for internal communication as well.

This PR will address that according to the ML thread, and only REST client will use hostname verification using the new configuration.

Brief change log

• Remove configuration security.ssl.verify-hostname which is not used in any recent released Flink version
• Add security.ssl.rest.verify-hostname which will only add hostname verification for REST connections
• Add test cases

Verifying this change

• By adding new tests with the already existing certificates found in the test suite

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): no
• The public API, i.e., is any changed class annotated with @Public(Evolving): no
• The serializers: no
• The runtime per-record code paths (performance sensitive): no
• Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
• The S3 file system connector: no

Documentation

• Does this pull request introduce a new feature? yes
• If yes, how is the feature documented? Updated documentation

[flinkbot]

CI report:

• c22362f Azure: SUCCESS

Bot commands

The @flinkbot bot supports the following commands:

• @flinkbot run azure re-run the last Azure build

[davidradl]

I do not think we should remove options. We should deprecate the old option and still allow it to work and have the documentation reference the new option as the preferred way of now doing things. Otherwise we get a failure when adopting this code.

[mateczagany]

Thank you for reviewing this PR, I've tried to explain this as best as I could in the description of the PR. This configuration was not used before the mentioned PR merged yesterday. However in the ML discussion it's clear that the implementation in that PR is wrong, and we should not have hostname verification for internal communication.

There will be a migration guide probably in the release blog post that this configuration was not working properly in any other recent release, and that users should use the new configuration.

[mateczagany]

If you prefer to have it marked as deprecated, we can do that, but overall this configuration should have no effect to stay consistent with previous Flink releases.

We can note in the description that the user should use the new configuration option to have hostname verification for external connections.

[mateczagany]

I have re-added the old configuration as deprecated, and hidden from the docs.