[anton-vinogradov]

IGNITE-29211 adds optional automatic TLS certificate renewal. Nodes read replacements from the configured source before expiry. Ignite does not issue certificates.

Behavior

• Renewal is disabled by default. SslContextFactory calculates renewal dates from the key store actually loaded, including custom sources. Attempts start with 15% of the selected chain's lifetime remaining.
• Manual and automatic replacements use the same init() path and validate every certificate in the private-key chains. Currently valid certificates are accepted with equal, earlier or later expiry, including identical certificates and trust-store-only changes. The same validity check applies at startup, including in client applications and the control script.
• Loading or validation failures preserve the current context and renewal date. A successful load installs the context for new connections; established connections remain open. The manual command reports reloaded, including when the material has not changed.
• Each node runs automatic attempts and manual reloads of enabled factories on one executor. Before the renewal registry starts, manual reloads of enabled factories fail without loading material. If an automatic load leaves renewal due, the attempt counts as a failure and retries with exponential backoff and jitter. The installed context remains in use. A successful manual reload clears that factory's failures and schedules its next attempt, immediately if still due.
• ssl.ConsecutiveRenewalFailures sums consecutive automatic failures on the node. ssl.ManualReloadAttempts and ssl.AutomaticRenewalAttempts count per-factory calls, including errors and automatic skips. They exclude startup, direct application calls and queued calls cancelled before execution.
• Shutdown cancels queued operations, interrupts the running executor task and waits for it to finish. A task already waiting for a shared factory may still load and install a valid replacement after shutdown starts.

The existing final void init() contract is preserved. renew() checks whether loading is due; the registry evaluates the resulting renewal date. Startup initializes missing renewal dates. Nodes sharing a factory keep separate schedules and may load it sequentially. A startup load already waiting for the factory may proceed after shutdown starts.

Renewal covers TCP transports. HTTPS remains in IGNITE-29212. Factories extending only AbstractSslContextFactory retain their own manual loading behavior.

Tests cover certificate dates, equal or earlier expiry, trust-only changes, failure recovery, scheduling, shutdown and metrics. They also cover the reload command and replacement on a live TLS connection.

Depends on IGNITE-29210, merged into Apache master.