Trust store: Overwrite conflicting ssl options and ensure cacerts set

[gomoripeti]

Proposed Changes

Addresses #15103

lists:keymerge/3 was used to merge required options into user provided ssl options, which assumes the input lists are sorted. No matter if the intention was to preserve user provided options or overwrite them in case of conflict, without sorting, the outcome was unpredictable. It is also somewhat surprising to those who are used to the behaviour of proplists:get_value (like me) that the ssl app (at least since OTP 26) takes the last value not the first when same key with multiple values are provided.

This commit makes sure the input lists are ordered. Also changes the behaviour of the plugin that all keys used by the plugin overwrite user provided values (fail_if_no_peer_cert, partial_chain, verify, verify_fun)

Also if the user did not provide a cacerts or cacertfile option, an empty cacerts list is added, as ssl config validation requires it in case verify_peer is enabled.

Types of Changes

What types of changes does your code introduce to this project?
Put an x in the boxes that apply

• Bug fix (non-breaking change which fixes issue #NNNN)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause an observable behavior change in existing systems)
• Documentation improvements (corrections, new content, etc)
• Cosmetic change (whitespace, formatting, etc)
• Build system and/or CI

Checklist

Put an x in the boxes that apply.
You can also fill these out after creating the PR.
This is simply a reminder of what we are going to look for before merging your code.

• Mandatory: I (or my employer/client) have have signed the CA (see https://github.com/rabbitmq/cla)
• I have read the CONTRIBUTING.md document
• I have added tests that prove my fix is effective or that my feature works
• All tests pass locally with my changes
• If relevant, I have added necessary documentation to https://github.com/rabbitmq/rabbitmq-website
• If relevant, I have added this change to the first version(s) in release-notes that I expect to introduce it

Further Comments