Align SSL hostname verification with TLS libraries

from pr https://github.com/mariadb-corporation/mariadb-connector-j/pull/230

HostnameVerifier.verify currently falls back to the certificate Subject Common Name (CN) even when the certificate presents Subject Alternative Names, which lets a cert be accepted for a host its SANs do not cover (e.g. CN=*.mariadb.org, SAN=[other.org, www.other.org] is wrongly accepted for a.mariadb.org).

The connector should match the default behavior of the standard TLS libraries (OpenSSL X509_check_host, LibreSSL, BoringSSL), which is also the RFC 6125 §6.4.4 rule:

Consult the CN‑ID only when the certificate presents no Subject Alternative Name of the type being matched. If a SAN of the matching type is present, the CN MUST be ignored even if none of those SANs match the reference host.

Concretely, gate the CN fallback on the absence of a SAN of the matching type, not on the absence of any SAN

connector will follow RFC 9525 (Service Identity in TLS, 2023) when TLS libraries will default to that too.