Support TLS for Postgres VSS stores

[zjma]

Summary

• add TLS-capable Postgres connections for the VSS store when sslmode=require is present
• generate new Cloud SQL VSS URLs with ?sslmode=require from the CLI
• keep existing URLs without sslmode=require on the non-TLS path for compatibility

Validation

• cargo check -p vss-store
• cargo check -p network-node
• cargo test -p vss-store
• pnpm --filter @aptos-labs/ace-cli typecheck
• git diff --check

Existing deployment rollout

0. DB must first be in dual mode: ALLOW_UNENCRYPTED_AND_ENCRYPTED. This is the current/default compatibility state and lets old no-SSL nodes keep running while new SSL-capable nodes roll out.
1. Merge and release this patch so nodes can connect with encrypted Postgres sessions.
2. Redeploy affected nodes with a VSS URL that includes sslmode=require. New CLI-generated deployments include it by default.
3. Verify node and VSS maintainer health while Cloud SQL still accepts both encrypted and unencrypted connections.
4. Only after all clients use TLS, patch Cloud SQL to ENCRYPTED_ONLY.

Rollback before step 4 is just redeploying nodes with the old URL. Rollback after step 4 is setting Cloud SQL back to ALLOW_UNENCRYPTED_AND_ENCRYPTED.

This is encrypt-only TLS for now. It intentionally does not enforce certificate/hostname verification because current private-IP Cloud SQL URLs use IP addresses; verified TLS should be a separate follow-up with CA/hostname/proxy handling.