fix(redis): verify TLS server certificates

[kevwan]

What this PR does

• enables Redis TLS with Go's secure certificate and hostname verification defaults
• adds WithTLSConfig for custom CA pools, server names, and client certificates
• clones caller-provided TLS configurations to prevent mutation and data races
• adds TlsInsecureSkipVerify as an explicit migration escape hatch for legacy self-signed deployments
• prevents plaintext and differently configured TLS clients for the same address from sharing a cached connection

Compatibility

This intentionally changes Tls: true and WithTLS() to verify server certificates. Deployments using an untrusted self-signed certificate or a hostname mismatch must configure the appropriate CA through WithTLSConfig, or temporarily set TlsInsecureSkipVerify: true.

Verification

• go test ./core/stores/redis -count=1
• go test -race ./core/stores/redis -count=1
• go vet ./core/stores/redis

Fixes #5644

[Copilot]

Pull request overview

This PR hardens core/stores/redis TLS behavior by switching Redis TLS to Go’s default certificate + hostname verification, adding a way to supply custom tls.Config, and ensuring the connection cache won’t reuse plaintext vs TLS (or different TLS policies) for the same address.

Changes:

• Replace the previous TLS behavior (which implicitly disabled verification) with secure TLS defaults and add WithTLSConfig to customize CA pools / ServerName / client certs.
• Add TlsInsecureSkipVerify to Redis config as an explicit migration escape hatch.
• Adjust client/cluster connection caching keys to separate plaintext vs TLS clients, and add/extend tests around TLS configuration behavior.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
core/stores/redis/redis.go	Introduces TLS config fields/options, TlsInsecureSkipVerify wiring, and a new manager cache key that includes TLS policy.
core/stores/redis/redisclientmanager.go	Uses TLS config cloning and the new manager key when creating/caching node clients.
core/stores/redis/redisclustermanager.go	Uses TLS config cloning and the new manager key when creating/caching cluster clients.
core/stores/redis/conf.go	Adds TlsInsecureSkipVerify to RedisConf and maps it to TLS options.
core/stores/redis/redisclientmanager_test.go	Adds tests for WithTLS, WithTLSConfig, cloning behavior, and cache separation by TLS policy.
core/stores/redis/redisclustermanager_test.go	Updates cluster test to use TLS config and asserts verification isn’t disabled.
core/stores/redis/redis_test.go	Adjusts TLS-related test setup to avoid blocking connection checks when TLS is enabled.
core/stores/redis/conf_test.go	Adds tests validating secure vs insecure TLS behavior from RedisConf/NewRedis.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!