[TLS] Add SSL config parsing and SslContext/SslHandler factory

[affo]

Search before asking

• I searched in the issues and found nothing similar.

Description

Part of #3786 (FIP-29: (m)TLS Support).

Wave 0 — no dependencies, can start immediately.

Add the foundational, currently-unused building blocks that later tickets wire into the Netty pipeline — no runtime behavior change on their own.

• SslConfig — parses keystore/truststore paths, passwords, type (JKS/PKCS12), enabled protocols, cipher suites from Configuration.
• SslContextFactory — builds a Netty SslContext/SslHandler from an SslConfig, for both server and client sides.
• New config options: security.ssl.enabled.listeners, security.ssl.enabled.protocols, security.ssl.cipher.suites, security.ssl.keystore.*, security.ssl.key.password, security.ssl.truststore.*, and the client.security.ssl.* mirror.
• Unit tests covering keystore/truststore loading, protocol/cipher restriction, and hostname-verification setup.

Depends on: none.
Depended on by: server pipeline integration (#3792), client pipeline integration (#3797), certificate hot-reload (#3799).

Estimated diff size: ~925 lines.

Willingness to contribute

• I'm willing to submit a PR!