Fix ra-tls certificate SAN generation for IP-only endpoints

[ameba23]

ra_tls::cert::CertRequest::into_cert_params converts every configured subject alternative name into SanType::DnsName, so an IP literal like 203.0.113.10 is encoded as a DNS SAN.

dstack/ra-tls/src/cert.rs

Lines 372 to 378 in 4b7372d

	if let Some(alt_names) = self.alt_names {
	for alt_name in alt_names {
	params
	.subject_alt_names
	.push(SanType::DnsName(alt_name.clone().try_into()?));
	}
	}

rustls/webpki requires IP endpoints to be represented as actual IP SANs, so name verification fails when clients connect by IP address. This makes it difficult to use ra_tls for IP-only hosts. See related issue in our attested-tls implementation which depends on ra-tls: flashbots/attested-tls#30

This PR delegates SAN parsing to rcgen::CertificateParams::new(...), which internally converts IP literals into SanType::IpAddress and leaves hostnames as DNS SANs.

So this is a behavioral change, but it only effects names which successfully parse as IP addresses.

A test covering mixed SANs is included which checks that:

• 203.0.113.10 is encoded as SanType::IpAddress
• test.example.com remains SanType::DnsName

[kvinwang]

LGTM, thanks for the fix!