GHSA-x5hg-x4gv-j98m: OpenSearch has ineffective TLS certificate hostname verification

A regression was introduced in OpenSearch 2.18.0 that caused the plugins.security.ssl.transport.enforce_hostname_verification setting to be ineffective. When this setting was enabled, OpenSearch did not verify that the hostname in a connecting node’s TLS certificate matched the hostname of the connection. This could allow a node with a valid certificate (signed by the cluster’s trusted CA) but an incorrect hostname SAN to join the cluster.