Add prompt format string for SSL/TLS version

[rolandwalker]

Description

\T will show the TLS version for the connection, or (none) when appropriate.

The negotiated version seems to require a trip to the server, but get_ssl_version() has been cached per thread_id so that we don't need to make that trip for every prompt refresh.

xref #1592

Checklist

• I added this contribution to the changelog.md file.
• I added my name to the AUTHORS file (or it's already there).
• To lint and format the code, I ran

  uv run ruff check && uv run ruff format && uv run mypy --install-types .

[github-actions]

Findings

• High: Cache key is only thread_id, which is not globally unique across servers or across reconnects. If a user connects to multiple servers or reconnects later and the new connection gets a reused thread id, \T can show a stale TLS version from a different connection. Consider keying by connection identity (e.g., id(connection) or (host, port, thread_id)), and clearing on disconnect. mycli/packages/special/utils.py
• Medium: Prompt rendering now depends on a server query when \T is used. If SHOW STATUS is not permitted, this will raise during prompt rendering and break the prompt flow, not just the status command. Consider catching DB errors in get_ssl_version and returning None so \T renders as (none). mycli/packages/special/utils.py, mycli/main.py

Missing tests / edge cases

• Add a unit test for \T substitution to ensure get_prompt renders (none) when get_ssl_version returns None. mycli/main.py
• Add a test (mocked) to ensure cache does not bleed across distinct connections with the same thread_id. mycli/packages/special/utils.py

Notes

• No obvious security issues beyond the above error handling.

If you want, I can draft a small test using a mocked cursor/connection to cover the cache key behavior.

[github-actions]

Findings

1. Stale SSL version across reconnects/server restarts
   get_ssl_version() caches by thread_id only and is never cleared. If the server restarts or a new connection reuses a thread_id, \T can show the previous connection’s TLS version. Consider clearing the cache on reconnect/disconnect or keying by connection object identity in addition to thread_id.
   File: mycli/packages/special/utils.py

2. Prompt can crash if connection is closed but sqlexecute.conn is still set
   get_prompt() unconditionally opens a cursor when \T is present and sqlexecute.conn is non-None. If the connection has dropped but the object remains, cursor()/execute() will raise and break prompt rendering. Consider checking connection liveness (e.g., conn.open, conn.ping(reconnect=False), or a try/except fallback to (none)).
   File: mycli/main.py

Missing tests / edge cases

• Add a unit test for \T prompt rendering when TLS is present and when it’s not (expect (none)).
• Add a test for prompt rendering when the connection object exists but is closed or invalid (should not raise; should fall back to (none)).

If you want, I can suggest concrete test additions in test/test_main.py.

[scottnemes]

Verified new \T prompt value works with and without SSL enabled.