fix: have ssl handshake check hostname

[jackwotherspoon]

For Cloud SQL we need to disable checking hostname of ssl handshake because IP address does not match SAN. However, for AlloyDB this is not the case and the IP address can be validated as the host name.

Fixes #324

[enocom]

We need to hold off on this until PSC DNS is populated in all existing certificates.

[nancynh]

LGTM, this is also good to merge in now that the PSC DNS is in all existing certificates

[enocom]

This looks perfectly correct, but obviously is missing something. Thanks for all the work on this @jackwotherspoon .

[enocom]

Via @jackwotherspoon

"HostName" contains the fully qualified DNS hostname of the server,
as understood by the client. The hostname is represented as a byte
string using ASCII encoding without a trailing dot.

https://datatracker.ietf.org/doc/html/rfc6066#section-3

[jackwotherspoon]

TLDR;

For wrap_socket and passing it to SSLContext, the trailing dot is invalid. However, the hostname match requires a perfect match to the DNS entry in the SAN which has the trailing dot. Thus, here we are, stuck with the hostname match failing.

[enocom]

Going to close this for now. We'll need to revisit some server settings I think.