feat(yarn_client): SSL/TLS config for YARN REST connections

Add per-Connection ssl_verify / ssl_ca_bundle plus global defaults so
CDH 5 / on-prem clusters with self-signed certs or custom CA bundles can
be queried without patching code.

- Connection gets ssl_verify (bool|None) and ssl_ca_bundle (str|None)
- Settings gets ssl_verify_default and ssl_ca_bundle_default
- New YarnClientConfig dataclass carries the resolved verify= value
- _request passes verify= through to httpx.request
- All public yarn_client functions now take YarnClientConfig instead of
  a bare yarn_rm_url string; tool call sites resolve the Connection
- SaveConnectionRequest exposes the two new fields

Tests cover per-connection CA bundle, per-connection verify=False,
global default fallback, and connection-not-found error.

tests/unit/test_connection_tools.py

@@ -65,6 +65,20 @@ def test_get_connection_returns_dict(_fresh_store):
     assert out["deploy_mode"] == "cluster"
     assert out["yarn_rm_url"] is None
     assert out["spark_conf"] == {}
+    assert out["ssl_verify"] is None
+    assert out["ssl_ca_bundle"] is None
+
+
+def test_save_connection_preserves_ssl_fields(_fresh_store):
+    connections.save_connection(
+        name="secure",
+        master="yarn",
+        ssl_verify=False,
+        ssl_ca_bundle="/tmp/ca.crt",
+    )
+    out = connections.get_connection("secure")
+    assert out["ssl_verify"] is False
+    assert out["ssl_ca_bundle"] == "/tmp/ca.crt"
 
 
 def test_get_connection_unknown_raises(_fresh_store):