fix(tls): validate public certificate SANs

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Closes rustfs/backlog#1086

Summary of Changes

• Centralize the server-certificate SAN validation policy in a helper that depends only on requireSanMatch.
• Keep public HTTPS certificate validation active when enableInternodeHttps=false.
• Add a reconcile-path regression test that rejects a mismatched public DNS SAN with internode HTTPS disabled and verifies the blocked Tenant status.

The original gate coupled SAN validation to internode HTTPS. Later TLS work removed that coupling in the main path, but the exact public-only behavior was not locked by a regression test. This change makes the policy boundary explicit and prevents the original issue from returning during future TLS refactors.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (N/A: no user-facing contract change)
• CHANGELOG.md updated under [Unreleased] (N/A: this repository does not contain CHANGELOG.md)
• CI/CD passed

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: public TLS configurations retain SAN enforcement independently of internode transport settings.

Verification

cargo test require_san_match_blocks_public_tls_during_reconcile_without_internode_https
make pre-commit

Additional Notes

The change does not enable internode HTTPS or alter generated SAN sets. It only makes the existing requireSanMatch policy independent and regression-tested through the TLS reconcile entry point.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.