feat: add TLS support for Redis templates

[joshrotenberg]

What

Adds TLS support to the Redis templates, so a TLS Redis no longer needs hand-rolled RunCommand plumbing with cert volume mounts and --tls-* args.

Single-node RedisTemplate

• .tls(certs_dir) -- bind-mounts the host cert directory read-only at /tls and starts redis-server with --tls-port, --tls-cert-file, --tls-key-file, --tls-ca-cert-file. Expects the conventional redis.crt / redis.key / ca.crt file names (documented).
• Plaintext stays open alongside TLS by default. TLS listens on container port 6380, published on a configurable host port (.tls_port(port), default 6380).
• .tls_only() -- disables the plaintext port via --port 0 and stops publishing it.
• Connection helpers account for TLS: tls_connection_string() returns the rediss:// URL; connection_string() falls back to the rediss:// endpoint in TLS-only mode (since plaintext is closed). TLS composes with password auth.

RedisClusterTemplate

• .tls(certs_dir) -- every node runs TLS-only on its data port with --tls-cluster yes / --tls-replication yes, mirroring Redis's documented cluster-over-TLS layout (the gossip protocol cannot mix plaintext and TLS nodes). Readiness polling, redis-cli --cluster create, cluster info, and node_role all connect with redis-cli --tls and the mounted certificates.

No new default dependencies

Self-signed cert generation is not pulled in as a heavyweight default. Instead the tls() rustdoc documents an openssl one-liner recipe, and the integration test generates throwaway certs with openssl in a temp dir.

Why

Closes the gap noted in the issue: redis-tower keeps TLS coverage on its process-based harness because the containerized templates could not exercise TLS. Template TLS lets the containerized version-matrix tier cover TLS paths too.

Evidence / test plan

• Unit tests for arg construction on both templates (TLS flags, cert mount, --port 0 in TLS-only, custom TLS port, password coexistence, rediss:// connection strings, cluster redis-cli --tls flag assembly). cargo test --lib --all-features: 841 passed.
• New tests/redis_tls_integration.rs: generates a self-signed CA + server cert with openssl, starts a TLS Redis, and asserts a redis-cli --tls ping returns PONG; a second test asserts plaintext is refused in TLS-only mode. Skipped automatically when Docker or openssl is unavailable. Both pass against a live Docker daemon (29.4.3).
• Existing tests/redis_template_integration.rs (7 tests incl. password and Redis Stack, which share the refactored build_command path) pass against live Docker -- no regression.
• Full gate green: cargo fmt --all, cargo clippy --all-targets --all-features -- -D warnings, cargo clippy --all-targets --no-default-features -- -D warnings, cargo doc --no-deps --all-features, cargo test --doc --all-features (422 passed).

Closes #244.