Reload atunnel client CA per handshake

[Yang Haoran (0YHR0)]

Fixes #688

What changed

• Reload and validate the atunnel client trust bundle for every TLS handshake through GetConfigForClient.
• Preserve the existing per-connection server certificate reload and SPIFFE client identity verification.
• Add a regression test that rotates the trust bundle and verifies that the accepted client CA changes without restarting the server.

Why

The server previously built ClientCAs only at startup. Long-lived workers therefore continued using stale CA material after the projected trust bundle rotated, rejecting newly valid router certificates and potentially retaining trust in the previous CA until restart.

Impact

Client CA rotation now takes effect on the next TLS handshake. A missing or malformed rotated trust bundle fails that handshake instead of silently falling back to stale trust material.

Validation

• go test -count=10 ./internal/atunnel
• go vet ./internal/atunnel
• git diff --check
• make verify (the changed internal/atunnel package passes, but the full repository suite is not Windows-compatible: Linux-only syscalls such as Flock, SIGUSR1, and SEEK_DATA, plus symlink privilege requirements, fail on this host)

Documentation changes are not needed because this fixes certificate rotation behavior without changing the public API or configuration.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.