feat(yarn_client): SSL/TLS config for YARN REST connections

Add per-Connection ssl_verify / ssl_ca_bundle plus global defaults so
CDH 5 / on-prem clusters with self-signed certs or custom CA bundles can
be queried without patching code.

- Connection gets ssl_verify (bool|None) and ssl_ca_bundle (str|None)
- Settings gets ssl_verify_default and ssl_ca_bundle_default
- New YarnClientConfig dataclass carries the resolved verify= value
- _request passes verify= through to httpx.request
- All public yarn_client functions now take YarnClientConfig instead of
  a bare yarn_rm_url string; tool call sites resolve the Connection
- SaveConnectionRequest exposes the two new fields

Tests cover per-connection CA bundle, per-connection verify=False,
global default fallback, and connection-not-found error.

common/config.py

@@ -76,6 +76,10 @@ class Settings:
     # The binary is resolved against $PATH (set by docker-entrypoint.sh).
     spark_submit_bin: str = "spark-submit"
 
+    # --- SSL/TLS defaults for YARN REST calls ---
+    ssl_verify_default: bool = True
+    ssl_ca_bundle_default: str | None = None
+
     @classmethod
     def from_env(cls) -> "Settings":
         data_dir = os.environ.get("SPARK_EXECUTOR_DATA_DIR", "./data")
@@ -95,6 +99,13 @@ class Settings:
             spark_submit_bin=os.environ.get(
                 "SPARK_EXECUTOR_SPARK_SUBMIT_BIN", "spark-submit"
             ),
+            ssl_verify_default=(
+                os.environ.get("SPARK_EXECUTOR_SSL_VERIFY_DEFAULT", "true").lower()
+                not in ("false", "0", "no", "off")
+            ),
+            ssl_ca_bundle_default=(
+                os.environ.get("SPARK_EXECUTOR_SSL_CA_BUNDLE_DEFAULT") or None
+            ),
         )
 
     def reload(self) -> "Settings":
@@ -110,6 +121,8 @@ class Settings:
         self.yarn_resource_manager_url = fresh.yarn_resource_manager_url
         self.log_level = fresh.log_level
         self.spark_submit_bin = fresh.spark_submit_bin
+        self.ssl_verify_default = fresh.ssl_verify_default
+        self.ssl_ca_bundle_default = fresh.ssl_ca_bundle_default
         return self