[DocDB] yb-admin xCluster verify commands cannot reach a source universe with a different certificate authority

Jira Link: DB-23658

Description

verify_xcluster_slice and verify_xcluster_group cannot verify a replication pair whose two universes were provisioned with separate certificate authorities, which is the normal case for universes installed independently.

These are the only yb-admin commands that connect to a second universe directly from the client. Every other cross-universe command (setup_universe_replication, create_xcluster_checkpoint, and the rest) sends an RPC to the local master, which reaches the peer using the certificates staged under certs_for_cdc_dir. The verify commands instead build a second ClusterAdminClient in the tool itself, and that client took its secure context from --certs_dir_name, which names the universe the tool was pointed at. The source handshake is then rejected because the source masters do not trust the target's authority.

No flag combination worked around it: pointing --certs_dir_name at the source's certificates only moved the failure to the target connection.

Steps to reproduce

1. Bring up two TLS-enabled universes with different certificate authorities and set up xCluster replication between them.
2. On a target node, run yb-admin --master_addresses <target-masters> --certs_dir_name <target-certs> verify_xcluster_group <replication-group-id>.

The command fails after the client's RPC timeout with:

Timed out: Unable to connect to source masters [...]: Could not locate the leader master

The master log on the source shows the handshake being rejected as an unverified certificate. The timeout lands at 60 seconds, the YBClient default, rather than at --timeout_ms, which is what distinguishes this from an ordinary network failure.

Issue Type

kind/bug

Warning: Please confirm that this issue does not contain any sensitive information

I confirm this issue does not contain any sensitive information.