[tisonkun]

Which issue does this PR close?

No linked issue.

Rationale for this change

The Etcd builder applies TLS options only when ca_path, cert_path, and key_path are all present. A client that only needs to trust a private CA therefore cannot connect to an HTTPS server unless it also configures a client identity.

Reproduced at 2af16fa07a72c298c2b291bc593e79cf00d6aac4 against Etcd 3.6.4 with the repository's server certificate and client certificate authentication disabled. With an HTTPS endpoint and only ca_path, OpenDAL fails on the first write with UnknownIssuer, while etcdctl --cacert connects successfully. After this change, the same OpenDAL configuration writes, reads, and deletes successfully.

To exercise this configuration, start the new fixture and run the existing behavior suite with no client certificate or key configured:

docker compose -f fixtures/etcd/docker-compose-standalone-server-tls.yml up -d --wait
cd core
OPENDAL_TEST=etcd \
OPENDAL_ETCD_ENDPOINTS=https://127.0.0.1:2379 \
OPENDAL_ETCD_CA_PATH="$PWD/../fixtures/etcd/ca.pem" \
OPENDAL_ETCD_MAX_DECODING_MESSAGE_SIZE=10485760 \
cargo test --test behavior --features tests,services-etcd

What changes are included in this PR?

• Apply the server CA independently of the optional client identity.
• Reject incomplete cert_path / key_path pairs with ConfigInvalid before reading certificate files.
• Add a server-authenticated TLS fixture to the behavior CI matrix, alongside the existing mutual TLS fixture.
• Document the TLS configuration contract and regenerate the Java, .NET, and website configuration descriptions.
• Update all 1Password/load-secrets-action references to the ASF-approved v5.0.1 SHA (70062d7a876d3eb6334754fa26efd2fbd90c32f2). The v4.1.1 approval expired on October 30, causing the ASF Allowlist Check to reject 27 action references. The Action input declarations are unchanged.

Validation against real Etcd 3.6.4: all 109 behavior tests passed in each of the CA-only TLS, mutual TLS, and plain HTTP configurations. Service unit tests, doctests, focused Clippy with warnings denied, and formatting checks passed. The behavior planner includes the new fixture. The ASF checker from the failing run was also reproduced locally: 27 rejected references before the pin update, and all 35 unique action references approved afterward.

Are there any user-facing changes?

ca_path now takes effect without a client certificate or private key. Supplying only one client identity path fails during operator construction. An explicit HTTP endpoint combined with CA-only configuration now produces the underlying client's TLS configuration error instead of silently ignoring the CA. An HTTPS endpoint without a trusted CA continues to fail certificate verification.

Breaking changes

AI Usage Statement

• Harness: Codex desktop. Model: GPT-6; the exact variant is not exposed to the agent. Effort: not exposed to the agent. Role: reproduced the failure against real Etcd, implemented the fix and tests, updated documentation and CI action pins, and drafted this PR.
• Harness: ASF ASVS scanner. Models: gemma4-26b, qwen3-8b, and qwen3.8-27b, as listed in the scan metadata. Effort: not recorded. Role: supplied the initial finding that TLS configuration could be ignored; the metadata does not identify which model produced this specific finding. The connection behavior described above was independently reproduced.