[datlechin]

Summary

• MariaDB's mariadb-dump and mariadb run with a private plugin folder whenever the session might go without TLS: SSL Mode Disabled, or Preferred against a server that offers none. The folder links only caching_sha2_password, sha256_password, client_ed25519, parsec, auth_gssapi_client and zstd, so a server asking for mysql_clear_password, dialog (PAM) or Homebrew's qa_auth_client gets 2059 before anything is sent. The failure reads as in the app: set SSL Mode to Required, or turn TLS on.
• A client with either plugin compiled in ignores the folder, so the app first asks the tool, against a loopback stand-in server with an empty folder, and refuses one that answers or one it could not check. Only a definite answer is cached.
• Preferred reads the server's greeting (no credentials sent) before a MariaDB tool runs. TLS offered: --ssl --skip-ssl-verify-server-cert as before. None: --skip-ssl and the folder, because --ssl falls back to plaintext and then answers caching_sha2_password full authentication with the typed password. A greeting that cannot be read stops the run.
• The tool's plugin folder is found at lib/plugin or lib/mysql/plugin (MariaDB's layouts, Homebrew) or plugin (MacPorts) beside its bin.
• A unix socket, the Cloud SQL Auth Proxy, an SSH forward to the server's socket, Required and the verify modes keep every plugin, so an IAM token still signs in over TLS. MySQL's own tools are unchanged.
• A cancel during these checks stops them and reads as cancelled. The plugin folder and MongoDB's credentials file are removed when the tool cannot launch or a cancel arrives first.
• Probes: new check-mysql-dump-plaintext-password.sh; the fake server in mariadb-tls-modes takes --auth cleartext|dialog|qa|sha2-full in place of --cleartext; check-mysql-dump-tool-flags.sh checks --plugin-dir.

Test plan

• check-mysql-dump-plaintext-password.sh with mariadb-dump and mariadb 13.0.2 from Homebrew: 18/18 ok. The old Preferred options send the password to a server without TLS (last row of each tool); the new ones never do, and a native login still works.
• check-mariadb-tls-modes.sh and check-mysql-dump-tool-flags.sh pass.
• MySQL 8.4 and MariaDB 11.4 in Docker with max_connect_errors=1 and name resolution on: three greeting probes in a row, then a login, still succeed.
• MySQLDumpPlaintextPasswordTests, MySQLDumpPlaintextPasswordServiceTests, MySQLClientArgumentsTests, NativeDumpRegistryTests, NativeDumpService*Tests, ProcessNativeDumpRunnerTests, NativeDumpScopeTests pass.

Follow-up to #3734. Docs: TableProApp/docs#95.