Pool cache key ignores all TLS params (ssl_mode/ssl_ca/ssl_cert/ssl_key)

[aesslinger]

Summary

connection_key in src/client.rs:220-229 keys the pool cache purely on
host:port:database:user:startup_script. It does not fold in ssl_mode,
ssl_ca, ssl_cert, or ssl_key at all.

This is unlike the built-in driver, which already kept ssl_mode/ssl_ca
in its build_connection_key before tabularis#666
added ssl_cert/ssl_key on top:

// builtin, pre-#666:
let ssl_ca = match ssl_mode {
    "verify-ca" | "verify-full" => params.ssl_ca.as_deref().unwrap_or(""),
    _ => "",
};
Some(format!("ssl:{ssl_mode}:{ssl_ca}"))

So this plugin's gap is broader than the client-cert-specific one fixed in
#34/#35 — it predates that work and isn't shared with the builtin.

Impact

Two connection requests identical on host:port:database:user:startup_script
but differing in any TLS param (ssl_mode, ssl_ca, ssl_cert, ssl_key)
will incorrectly share a cached pool and its already-negotiated TLS
configuration — e.g. a require-mode connection could reuse a pool that was
actually built with verify-full + a specific CA/client cert, or vice versa.

Proposed fix

Fold ssl_mode, ssl_ca, ssl_cert, and ssl_key into connection_key's
format string, matching the builtin's build_connection_key shape (mode +
CA/cert/key values, mode-conditional where appropriate per the builtin's
match ssl_mode { "verify-ca" | "verify-full" => ..., _ => "" } pattern —
or simpler, always include the raw values since this plugin's key format is
already coarser than the builtin's in other ways, per the existing comment
at src/client.rs:216-219).

Add unit tests to src/client_tests.rs mirroring
connection_key_differs_by_*, e.g. connection_key_differs_by_ssl_mode,
connection_key_differs_by_ssl_cert, etc.

Noted as a follow-up during #34/#35's review — not folded into #35 since it's
a distinct, broader bug (all TLS params, not just cert/key).

[aesslinger]

Timeline: this was a parity miss, not a later upstream change

• Upstream added ssl_mode/ssl_ca to the PostgreSQL pool key on 2026-06-04 (tabularis#278, "Honor PostgreSQL TLS settings in pool key"). MySQL's key had included ssl_cert/ssl_key even earlier than that.
• This plugin's src/client.rs (including its own connection_key) was staged on 2026-08-11 — over two months after #278 landed upstream.

So this isn't a case of upstream evolving after the plugin was extracted; the plugin's connection_key was written from scratch without picking up the TLS-param keying upstream already had at the time. Straightforward parity miss, worth fixing per this repo's CLAUDE.md parity mandate.

[aesslinger]

Fixed in #37 — folded ssl_mode/ssl_ca/ssl_cert/ssl_key into connection_key, matching the builtin's TLS-param keying shape. Added tests confirming the key now differs by each TLS param independently (connection_key_differs_by_ssl_mode/_ssl_ca/_ssl_cert/_ssl_key_alone).

Branched off main separately from #35 (client-cert connector fix) since they touch different functions with no overlap — both target the same upcoming beta tag.