[BUG] - TLS hostname verification disabled by default

[dyingman1]

Describe the bug
PulsarProperties.java defaults enableTlsHostnameVerification to false, meaning TLS connections between the Pulsar client and broker accept any valid certificate regardless of hostname mismatch. An attacker with network access can perform a man-in-the-middle attack using a legitimate certificate for a different domain.

To Reproduce
Steps to reproduce the behaviour:

1. Configure the Pulsar client with TLS:

pulsar:
  service-url: pulsar+ssl://broker.example.com:6651

2. An attacker intercepts the TLS connection (e.g., ARP spoofing, DNS poisoning) and presents a valid TLS certificate for attacker.com (obtained from a public CA).

3. The Pulsar client:

   • Checks CA trust: PASS (the attacker's cert is from a valid CA)
   • Checks hostname: SKIPPED (verification disabled)
   • Connection accepted

Expected behaviour
The default for enableTlsHostnameVerification should be true. The auto-configuration logic should enable hostname verification by default and only disable it when explicitly configured:

pulsarClientBuilder.enableTlsHostnameVerification(
    pulsarProperties.isEnableTlsHostnameVerification());

Additional context

• CWE-295: Improper Certificate Validation
• Without hostname verification, an attacker with a valid TLS certificate for any domain can intercept Pulsar traffic
• Combined with the SSRF vulnerability (Producer implementation #1), this allows a complete TLS bypass when service-url is also attacker-controlled