test(tls): pin use_tls=False to client config, not negotiated cipher

test_insecure_connection asserted Ssl_cipher == '', but a MySQL 8 server with
TLS configured (the datajoint/mysql:8.0 test image) can negotiate TLS during
connection setup even when the client requests no SSL. Whether the cipher ends
up empty depends on the resolved client stack, so the assertion passed on the
py3.13 solve but failed on the py3.10/py3.14 matrix added in this PR. Assert
what DataJoint actually controls: use_tls=False sends no client-side SSL config
and the connection is usable.

Author: dimitri-yatsenko

tests/integration/test_tls.py

@@ -38,9 +38,21 @@ def test_ssl_auto_detect(db_creds_test, connection_test, caplog):
 
 
 def test_insecure_connection(db_creds_test, connection_test):
-    """When use_tls=False, SSL should not be used."""
-    result = dj.conn(use_tls=False, reset=True, **db_creds_test).query("SHOW STATUS LIKE 'Ssl_cipher';").fetchone()[1]
-    assert result == ""
+    """When use_tls=False, DataJoint must not configure client-side TLS.
+
+    Note: this pins what DataJoint controls, not the negotiated cipher. A
+    MySQL 8 server with TLS configured may still negotiate TLS during
+    connection setup (e.g. to protect the auth handshake) even when the client
+    requests no SSL, so ``Ssl_cipher`` is not guaranteed to be empty and must
+    not be asserted on — doing so made this test depend on the resolved client
+    stack rather than on DataJoint behavior.
+    """
+    conn = dj.conn(use_tls=False, reset=True, **db_creds_test)
+    # DataJoint sent no client-side SSL configuration.
+    assert conn.conn_info.get("ssl_input") is False
+    assert "ssl" not in conn.conn_info
+    # The connection is usable without client TLS.
+    assert conn.query("SELECT 1").fetchone()[0] == 1
 
 
 @requires_ssl