Add TLS peer name verification for clients

[wwbmmm]

What problem does this PR solve?

Issue Number: null

Problem Summary:

Client TLS verification validates the certificate chain, but callers cannot
configure the DNS name or IP address expected in the peer certificate. This
makes it possible for a trusted certificate issued for another endpoint to be
accepted when only chain verification is configured.

What is changed and the side effects?

Changed:

• Add VerifyOptions::expected_peer_name for DNS name and IP SAN validation.
• Derive the expected peer name from the host in an HTTPS Channel URL when
  certificate verification is enabled and no explicit peer name is configured.
• Configure OpenSSL peer name verification as part of certificate verification.
• Reject peer name verification when certificate verification is disabled or
  the TLS backend cannot support it.
• Include the verification mode and expected peer name in the channel signature
  to prevent connections with different verification settings from being
  shared.
• Add tests for matching DNS names, mismatched DNS names, IP SAN mismatches, and
  invalid verification configurations.

Side effects:

• Performance effects: one DNS name or IP SAN comparison is added during a TLS
  handshake when expected_peer_name is configured.
• Breaking backward compatibility: HTTPS Channels with certificate verification
  enabled now reject certificates that do not match the URL host. Callers that
  intentionally connect through an alias can set expected_peer_name explicitly.
  OpenSSL versions older than 1.0.2 and MesaLink reject configurations that
  require peer name verification because they do not provide the required API.

---

Check List:

• The project builds with make -j6 in build.
• build/test/brpc_ssl_unittest passes.
• Related tests cover matching and mismatched peer identities.

[Copilot]

Pull request overview

This PR strengthens client-side TLS identity verification in bRPC by adding configurable peer name checks (DNS name / IP SAN) and defaulting HTTPS channels to verify the URL host when certificate verification is enabled, preventing trusted-but-wrong certificates from being accepted.

Changes:

• Added VerifyOptions::expected_peer_name and used it to configure OpenSSL hostname/IP verification (with explicit rejection on unsupported TLS backends / OpenSSL versions).
• Derived expected_peer_name automatically from the HTTPS URL host when verification is enabled and no explicit value is set, and included verification settings in the channel signature to avoid cross-sharing connections.
• Added/updated unit tests covering correct and incorrect peer identities and invalid verification configurations.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/brpc_ssl_unittest.cpp	Adds SSL unit tests for expected peer name verification behavior and invalid configurations.
test/brpc_channel_unittest.cpp	Extends URL parsing tests to assert expected_peer_name is derived for HTTPS when verification is enabled.
src/brpc/ssl_options.h	Introduces VerifyOptions::expected_peer_name as a new verification configuration field.
src/brpc/details/ssl_helper.cpp	Configures OpenSSL host/IP verification parameters when expected_peer_name is set; rejects invalid configs/unsupported versions.
src/brpc/details/mesalink_ssl_helper.cpp	Rejects expected_peer_name because MesaLink lacks required peer-name verification support.
src/brpc/channel.cpp	Derives SNI + expected peer name from HTTPS URL host and includes verification mode/peer name in the channel signature.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.