[TLS] Add certificate hot-reload and TLS metrics

[affo]

Search before asking

• I searched in the issues and found nothing similar.

Description

Part of #3786 (FIP-29: (m)TLS Support).

Wave 2 — depends on: SSL config & context foundations (#3796), server pipeline integration (#3792).

Certificates rotate; add hot-reload so a process restart isn't required to pick up renewed key material.

• SslContextProvider — indirection in front of the SslContext; background task on security.ssl.reload.interval (default 5 min, 0 disables) rebuilds the context when key material changes; atomic single volatile-reference swap; keeps the last-known-good context and logs a WARN on a failed rebuild.
• Change detection resolves symlinks (Path.toRealPath()), so it catches the Kubernetes/cert-manager ..data symlink-swap pattern, not just in-place rewrites.
• Reactive/self-healing reload: force-reload before a handshake if the certificate is expired/near-expiry, and after a handshake failure consistent with stale material when the on-disk file has changed — both triggers share one hard-coded rate limit.
• Near-expiry WARN logging (default 7-day threshold), independent of whether polling is enabled.
• New metrics: tls.handshake.failures (counter, per listener), tls.certificate.days.to.expiry (gauge, per listener).

Depends on: SSL config & context foundations (#3796), server pipeline integration (#3792).

Estimated diff size: ~585 lines.

Willingness to contribute

• I'm willing to submit a PR!