Tests: align SSL hostname tests with OTP SAN verification

[WarpEngineer]

What this PR does

Updates SSL test fixtures so that hostname verification works without custom overrides.

• Remove the custom customize_hostname_check match function from riak_core_tcp_mon SSL tests.
• Regenerate test certificates/keys with SAN entries for CA and site certs (in addition to CN entries already present).
• Add OpenSSL config files and a test/CERT_GEN.md guide so cert generation is reproducible.

Info

Newer OTP hostname checks are stricter in latest OTP 26 patch, and previous test setup used a custom matching function.
New certs generated which include both CN and SAN entries and custom check removed. OTP will default to checking SAN and CN is still present for Riak's use.

For the Release notes:

Updated Riak Core SSL test certificates to include SAN-based hostnames/IPs and removed custom hostname-check override in failing test. This improves compatibility with stricter OTP hostname validation in latest OTP 26 patch release.

Anyone using certs needs to generate them with CN and SAN instead of only CN. Some openssl config files are included in the test directory along with a help file (CERT_GEN.md) on how to regenerate.

[martinsumner]

I've run through riak_test on OTP 26 latest, and there are no failures either in repl_all or core_all.

There are two places in Riak where certificate name validation is possible:

• via the PB API;
• using peer_common_name_acl in riak_repl.

The other places SSL is used - the handoff API, and the HTTP API cn validation is not possible. Nextgenrepl uses the API, and so inherits rules from there.

The riak_repl certificate verification, like the PB API, doesn't use OTP name checking, but digs directly into the certificate representation in OTP to extract the certificate name.

So although we have a unit test failure - I don't think there is an end-user facing issue to address. It might be that it was used in an old (deprecated) version of riak_repl - but I don't think there's anything documented which requires updating.