[Feature Request] Support TLS certificate fingerprint pinning

Is your feature request related to a problem?

Yes.

grpcurl currently supports standard TLS certificate validation through -cacert, as well as disabling verification with -insecure. However, it does not provide a way to pin the server certificate or public key by its SHA-256 fingerprint.

This is useful when:

• the client must connect only to a specific server certificate;
• the environment does not have a trusted public CA;
• the caller wants protection against an unexpected certificate or CA;
• grpcurl is used in automated scripts or diagnostic environments where certificate pinning is required.

Using -cacert is not equivalent to fingerprint pinning because it validates the certificate chain but does not require the peer certificate to match a specific fingerprint.

Proposed solution

Add an option that verifies the server certificate fingerprint after the TLS connection is established.

For example:

grpcurl \\
  -cert-fingerprint sha256:0123456789abcdef... \\
  api.example.com:443 \\
  list