feat(client): verify server certificates against the system root store (#5546)

transport.tls.trustedCaFile is installed as RootCAs, and omitting it sets
InsecureSkipVerify, so system-root verification cannot be selected directly.
Add an opt-in transport.tls.useSystemRoots that enables certificate
verification with RootCAs nil when no trusted CA file is set, allowing Go to
use system roots and native verification on macOS and Windows. Defaults are
unchanged.

test/e2e/v1/basic/client_server.go

@@ -177,6 +177,10 @@ var _ = ginkgo.Describe("[Feature: Client-Server]", func() {
 			client:      "transport.tls.enable = false",
 			expectError: true,
 		})
+		defineClientServerTest("useSystemRoots rejects the default self-signed server certificate", f, &generalTestConfigures{
+			client:      "transport.tls.useSystemRoots = true",
+			expectError: true,
+		})
 	})
 
 	ginkgo.Describe("TLS with custom certificate", func() {