caching_sha2_password authentication refused on COM_CHANGE_USER after a self-signed TLS handshake

The self-signed fingerprint handshake (MariaDB >= 11.4.1, password set, no pinned CA) is a
connect-time mode: TLS is told to accept the certificate, which is then authenticated by the
fingerprint hash of the ending OK packet, the connection failing with ER_SELF_SIGNED otherwise.

info.useFingerprintValidation stayed set for the life of the connection, so the restrictions that
mode puts on authentication plugins were re-applied to later commands. On COM_CHANGE_USER,
caching-sha2-password-auth.js refused full authentication with ER_SELF_SIGNED_SHA256 even though
the session peer had already been authenticated at connect time. Now that MariaDB provides
caching_sha2_password, changeUser() to such a user fails on any self-signed deployment.

Reported by fg0x0