external table clickhouse: Add SSL configuration options

[yokofly]

-- For local development (disable verification like Kafka's skip_ssl_cert_check)
CREATE EXTERNAL TABLE clickhouse_table
SETTINGS type = 'clickhouse', address = 'localhost:9440', database = 'default',
secure = 'true', ssl_verify_mode = 'none',
user = 'never', password = 'never', table = 'never'

-- For custom CA (like Kafka's ssl_ca_cert_file)
CREATE EXTERNAL TABLE clickhouse_table
SETTINGS type = 'clickhouse', address = 'localhost:9440', database = 'default',
secure = 'true', ssl_ca_cert_file = '/proton-enterprise/clickhouse-test/certs/ca.crt',
user = 'never', password = 'never', table = 'never'

-- For production (default - uses system trust store)
CREATE EXTERNAL TABLE clickhouse_cloud
SETTINGS type = 'clickhouse', address = 'your-cluster.clickhouse.cloud:9440', database = 'default',
secure = 'true', -- ssl_verify_mode defaults to 'relaxed'
user = 'user', password = 'pass', table = 'mytable'

[yokofly]

Leaving this open deliberately during offboarding triage -- it documents settings that already ship and are currently invisible to users.

Four settings on the ClickHouse external table have no documentation at all: ssl_verify_mode (none / relaxed / strict / once, default relaxed), ssl_ca_cert_file, ssl_cert_file and ssl_key_file. docs/sql-create-external-table.md currently documents only secure=true|false, and there are zero occurrences of ssl_verify_mode anywhere in this repo.

These are needed for any TLS connection that is not the default -- custom CA, mutual TLS, or turning verification off for local development. Without them users cannot discover that the capability exists.

This is roughly one section of writing, and the issue body already contains the three worked examples (local dev with verification off, custom CA, and the Cloud default). Assigned to @chenziliang.

Note it is not covered by either of the two open docs PRs (#658, #664), so it will not resolve itself.

---

Context added during @yokofly offboarding (account deactivated 2026-08-14). Deliberately left open -- see above.