mariabackup SST with ssl-mode=VERIFY_CA/VERIFY_IDENTITY and no CA falls back to verify=0 (encrypted but unverified), unlike rsync SST

The rsync SST script rejects a configuration that requests certificate verification but provides no
CA file or CA path:

```sh

1. scripts/wsrep_sst_rsync.sh:240-248
   if [ "${SSLMODE#VERIFY}" != "$SSLMODE" ]; then
   ...
   if [ -z "$SSTCA$SSTCAP" ]; then
   wsrep_log_error "Can't have ssl-mode='$SSLMODE' without CA file or path"
   exit 22
   fi
   ```

`wsrep_sst_mariabackup.sh` has no equivalent check. It validates the `ssl-mode` value
(`:564-571`), forces `encrypt=3` when a certificate/key is present (`:582-594`) and aborts only when
`ssl-mode != DISABLED` and `encrypt == 0` (`:610-618`). In `get_transfer()`, when `tcert`/`tcap` are
empty the CA branch at `:408-433` is skipped and the code takes `:395-405`:
`CN_option=""`, `tcmd="...,verify=0"` — i.e. the SST stream is encrypted but the peer certificate
is not verified, even though `ssl-mode=VERIFY_CA/VERIFY_IDENTITY` was requested.

1. 1. Expected result

`wsrep_sst_mariabackup` should reject (or at least fail closed with a clear error) the same
configurations that `wsrep_sst_rsync` rejects: a `VERIFY_*` mode without a usable CA file/path must
not silently downgrade to `verify=0`.