feat(yarn_client): SSL/TLS config for YARN REST connections

Add per-Connection ssl_verify / ssl_ca_bundle plus global defaults so
CDH 5 / on-prem clusters with self-signed certs or custom CA bundles can
be queried without patching code.

- Connection gets ssl_verify (bool|None) and ssl_ca_bundle (str|None)
- Settings gets ssl_verify_default and ssl_ca_bundle_default
- New YarnClientConfig dataclass carries the resolved verify= value
- _request passes verify= through to httpx.request
- All public yarn_client functions now take YarnClientConfig instead of
  a bare yarn_rm_url string; tool call sites resolve the Connection
- SaveConnectionRequest exposes the two new fields

Tests cover per-connection CA bundle, per-connection verify=False,
global default fallback, and connection-not-found error.

spark_executor/tools/connections.py

@@ -15,6 +15,8 @@ def save_connection(
     deploy_mode: str = "cluster",
     yarn_rm_url: str | None = None,
     spark_conf: dict[str, str] | None = None,
+    ssl_verify: bool | None = None,
+    ssl_ca_bundle: str | None = None,
 ) -> dict[str, str]:
     logger.debug(
         f"save_connection enter name={name} master={master} deploy_mode={deploy_mode} "
@@ -26,6 +28,8 @@ def save_connection(
         deploy_mode=deploy_mode,
         yarn_rm_url=yarn_rm_url,
         spark_conf=spark_conf or {},
+        ssl_verify=ssl_verify,
+        ssl_ca_bundle=ssl_ca_bundle,
     )
     store.save(conn)
     return {"name": name, "status": "SAVED"}