mysql: track the auth plugin and seed from an authentication switch request

Fixes #441

Problem

MySQLConnection stores authenticationMethod and authenticationSeed from the initial handshake only (onHandshake). switchAuthentication() answers the server's authentication switch request but never records the plugin and seed it carries.

That breaks any server whose default plugin differs from the account's plugin, for example:

• the handshake advertises mysql_native_password (server default, e.g. default_authentication_plugin=mysql_native_password, or a managed MySQL 8.0 service), but
• the account uses caching_sha2_password.

The flow is: handshake (native) -> client response -> auth switch request (caching_sha2_password, new seed) -> client scramble -> AuthMoreData(0x04) (cold server cache, full authentication required). onAuthMoreData then checks the stale handshake plugin and throws:

java.lang.IllegalStateException: AuthMoreDataMessage is only supported for 'caching_sha2_password' method

Every new connection fails while the server's caching_sha2_password cache is cold (after a restart, FLUSH PRIVILEGES, ALTER USER), and works again once another client has populated the cache (AuthMoreData(0x03) is accepted without looking at the plugin). Even with the plugin check fixed, the RSA path would scramble the password with the stale handshake seed instead of the seed from the switch request, so both values need updating.

Not a TLS/sslMode issue: it fails identically with Mode.Disable and Mode.Prefer.

Fix

Record the plugin and seed from the switch request before answering it:

override fun switchAuthentication(message: AuthenticationSwitchRequest) {
    this.authenticationMethod = message.method
    this.authenticationSeed = message.seed
    ...
}

No behavior change when the handshake and the account use the same plugin (no switch happens).

Tests

• AuthenticationSpec.cachingSha2PasswordAuthenticationWhenServerAdvertisesNativePasswordInHandshake: real MySQL 8.0.32 started with --default-authentication-plugin=mysql_native_password, accounts created WITH caching_sha2_password. Mirrors the existing cachingSha2PasswordAuthentication test: cold cache without SSL fails with the unsafe-connection error, full authentication with SSL, fast authentication, full authentication with an RSA public key.
• AuthenticationSwitchSpec (new, no Docker): an in-process fake MySQL server scripts the exact packets, which also covers things a real server can't be made to do on demand:
  • full authentication after a switch from a native handshake scrambles the password with the switch seed (the server side decrypts the RSA packet and checks it);
  • fast authentication after a switch sends nothing further;
  • full authentication without a switch still uses the handshake seed (regression guard);
  • full authentication after a switch with no SSL and no RSA key fails with the existing unsafe-connection error;
  • a switch to mysql_native_password completes;
  • AuthMoreData after a switch away from caching_sha2_password is rejected (the plugin check now reflects the plugin actually in use).

Verification

Note: on my machine (Apple silicon, Docker Desktop) MySQLConnectionSpec."connect to a MySQL instance with unix domain socket" fails with and without the change (connection refused), and sha256Authentication failed once in the full run on container startup (mysql:5.7.32) and passed when rerun. Neither relates to this change.

Run locally with JDK 17 and -PTEST_CONTAINERS_VERSION=1.21.4: the pinned Testcontainers 1.17.6 can't talk to a current Docker daemon (API too old). That override is not part of this PR.

🤖 Generated with Claude Code