feat(redis): support TLS connections

[gnolong]

Summary

• support redis:// and rediss:// with explicit ssl_mode overrides
• add TLS for both redis-rs command connections and the custom PSYNC stream
• support Redis disable, require, and verify_ca modes, including Cluster node connections
• add reusable server TLS fixtures and Redis 6.2, 7.0, and 8.0 integration coverage

[gnolong]

Redis TLS E2E Test Results

Tested PR head: 3a7a1e078130a8c32873da378716e712d8ea9fe7

Images:

• ape-dts: pr587-release-amd64-3a7a1e07
  • Runtime digest: sha256:f0ad20e1e831735453ca9b4d6394940f1886145499e521514e0377cac0b76472
• ape-dts-bench: 0.0.34
  • Runtime digest: sha256:2e218dfa071f8a95026caeccfb97967adadd74b4f79ff40c8961743b4622cc0b

Common configuration

• Source and destination TLS enabled
• Extractor and sinker: ssl_mode=require
• Extractor and sinker: empty ssl_ca_path
• Certificate verification disabled; transport encryption enabled
• Extract type: Redis snapshot
• Sink batch size: 200
• Pipeline buffer size: 16000
• Redis parallelizer size: 4
• Source seed: 100,000 Redis Hash keys using the sysbench_nosql workload
• Destination emptied before migration
• Network latency injection disabled
• One run per topology

Test matrix

Topology	Source	Destination	Migration result	Tool runtime	Independent validation
Redis standalone	1 Redis node	1 Redis node	Passed	3.35s	TLS PING succeeded; source 100,000 keys; destination 100,000 keys
Redis Cluster	3 shards, 2 replicas per shard	3 shards, 2 replicas per shard	Passed	1.38s	TLS PING succeeded; source 100,000 keys; destination 100,000 keys

Both Helm benchmark runs completed with 1 passed, 1 skipped. The independent checks used a TLS Redis client with certificate verification disabled and scanned the benchmark key namespace on both endpoints.

All Helm releases, output PVCs, and database clusters created for these tests were removed after validation.