atunnel: refresh client CA pool per handshake

[LiorLieberman]

In internal/atunnel/server.go the client CA pool is built once at startup, while leaf certificates are reloaded per connection. Because substrate certs expire within ~1–2 days, a frozen CA pool means the server will eventually reject valid peers (or keep trusting a rotated-out CA) until it restarts.

Implement tls.Config.GetConfigForClient so the client CA pool is re-read on each handshake, mirroring the existing per-connection leaf cert reload.

source: #559 (comment)

[0YHR0]

I'd like to work on this. I plan to reload and validate the client trust bundle through tls.Config.GetConfigForClient for each handshake, while preserving the existing per-connection certificate reload and identity verification. I'll also add a regression test that rotates the trust bundle without restarting the server.