feat: MongoDB TLS CA fields + DocumentDB connection type

[jiatolentino]

MongoDB TLS CA fields

• Add tls_ca_file: str = "" and tls_allow_invalid_certificates: bool = False to MongoConnectionConfig.
• Serialize them under the existing TLS handling (matching the DM-3391 to_api_dict spec):
  • emitted only when tls is enabled,
  • tls_ca_file only when set,
  • tls_allow_invalid_certificates only when True.
• Inbound deserialization round-trips both fields.

AWS DocumentDB connection type

• Add DatabaseType.documentdb.
• Add DocumentDbConnectionConfig, a thin subclass of MongoConnectionConfig that differs only by its db_type / database_type discriminator (inherits all fields, TLS handling, and serialization).
• Register it in DB_TYPE_MAP and export it from datamasque.client.

Testing

• New unit tests in tests/test_connections.py:
  • TLS fields present/absent, the TLS-disabled case (neither key sent), and round-trip;
  • DocumentDB serialization (db_type=documentdb, retry_writes passthrough) and validate_connection dispatch to DocumentDbConnectionConfig.
• Full suite green: pytest (358 passed), ruff, and mypy all clean.

Notes

• Purely additive (144 insertions, 0 deletions); no behaviour change for existing connection types.
• Refs: DM-3842, DM-3715 (follow-on from DM-3391 / DM-3419).