initial-handshake cleartext password leak

mysql_clear_password as the initial-handshake plugin leaks the cleartext password to a MitM under sslMode=verify-full/verify-ca without a pinned certificate.

With verify-full/verify-ca + password + no CA, the connector accepts a self-signed cert at the TLS layer and enforces server identity afterwards via certificate-fingerprint binding. That guard exists on the OK-packet and auth-switch paths but not on the initial-handshake path: when a rogue/MitM server names mysql_clear_password as the initial plugin, HandshakeResponse.encode() checks only that SSL is enabled and sends the password in cleartext before any fingerprint check. The connection is rejected immediately after, but the credential is already disclosed.

Affected: sslMode=verify-full/verify-ca, non-empty password, no serverSslCert/trustStore. Not affected when a certificate is pinned, or sslMode=trust/disable.