SCH: verify MOVING handoff with TLS (SNI/hostname verification against the mapped endpoint)

Follow-up to https://github.com/redis/jedis/pull/4668#discussion_r3854325532.

During a MOVING pre-handoff, DefaultJedisSocketFactory remaps only the TCP connect address; createSslSocket(...) still uses the originally configured endpoint for SNI and hostname verification. With TLS and FQDN endpoint types (the auto-resolver requests *_FQDN under TLS), the handshake against the moved endpoint is unverified behavior: targets with hostname-specific certificates or SNI-based routing could fail verification or route incorrectly.

Scope:

1. Add a scenario test verifying the MOVING handoff with TLS enabled (e.g. public FQDN endpoint type): new connections must complete the TLS handshake against the notification's target. Redis Enterprise endpoints typically share the cluster's wildcard certificate, so old and new names may verify under the same SAN — the test should confirm this holds through a rebind.
2. If verification against the mapped target fails, propagate the mapped hostname into TLS socket creation and hostname verification.