Disable MySQL TLS peer verification when no ca_cert is set

[philippthun]

MariaDB Connector/C 3.4.x (shipped since capi-release 1.242.0) verifies the server certificate by default. When Cloud Controller connects to a MySQL database without ccdb.ca_cert - as use-external-dbs.yml does after removing the CA, e.g. against GCP Cloud SQL's self-signed CA - there is no CA to verify against, so the connection fails with "unable to get local issuer certificate".

Set MARIADB_TLS_DISABLE_PEER_VERIFICATION=1 for every path that opens a ccdb connection, but only when the scheme is mysql and no ca_cert is configured:

• the bpm environment of the long-running CC processes (cloud_controller_ng and its local_worker, cloud_controller_worker, cloud_controller_clock, cc_deployment_updater);
• the cloud_controller_ng pre-start hook, which runs DB migrations, seeding and encryption-key validation outside bpm (chpst preserves the exported variable for those scripts);
• the rotate_cc_database_key and blobstore_benchmark errands, which boot CC and connect to the database.

This restores the pre-3.4.x encrypt-without-verify behavior for that path. When a ca_cert is set, verification stays on. The variable is only set for MySQL; Postgres uses libpq and is unaffected.

Add template rendering tests covering the three paths (mysql without ca_cert, mysql with ca_cert, postgres) for the bpm templates of all four jobs, the cloud_controller_ng pre-start hook, and the rotate_cc_database_key and blobstore_benchmark errands.

• I have viewed signed and have submitted the Contributor License Agreement

• I have made this pull request to the develop branch

• I have run CF Acceptance Tests on bosh lite