Support TLS 1.3 mTLS: add TLS-version option for cert/A2A (JSSE has no client PHA)

[DanPeterson]

Context

SPP 9.0 (Windows 11 base OS) introduces TLS 1.3 support. When SafeguardJava performs certificate-based authentication (RSTS cert grant / A2A credential retrieval) and the connection negotiates TLS 1.3, authentication fails (server returns 60094 Authorization is denied). Over TLS 1.2 the same cert auth succeeds.

Root cause (SDK side)

On TLS 1.3 the client certificate is requested post-handshake (PHA, RFC 8446 Section 4.6.2). JSSE (tested on JDK 11) does not present a client certificate in response to a post-handshake CertificateRequest, so cert/A2A auth fails on a TLS 1.3 connection while working on TLS 1.2. This is a JSSE/SDK limitation. Scope of this issue is the SDK only.

Requested enhancements (SDK)

1. Add an opt-in TLS-version / protocol control (off by default). Allow callers to constrain the SSLContext / enabled protocols (e.g. pin TLSv1.2) for the cert-auth HTTP client, as an interim measure in environments negotiating TLS 1.3. Default should negotiate normally; the pin must be explicit opt-in.
2. Document the JSSE client-PHA limitation in the cert-auth / A2A docs, including the TLS 1.2 vs 1.3 behavior and the opt-in.
3. (If feasible on supported JDKs) investigate any JSSE configuration that would allow the client to present its certificate post-handshake, and document findings.

Acceptance

• Certificate auth / A2A retrieval works with the documented configuration against an SPP 9.0 appliance.
• TLS-version/protocol control is opt-in and documented.
• JSSE limitation and guidance documented.