## TL;DR

remote `db dump` and the first `db pull` seed now pass the resolved TLS
settings to `pg_dump`
## whats introduced?

`pg_dump` only got host, port, user, password and database, so a
container dump ignored `PGSSLMODE=verify-full`, trusted any CA, and got
turned away by servers that require a client cert.

for the linked project and a remote `--db-url`, it now gets the resolved
`sslmode` and connect timeout, the root cert under `require` or
`verify-*`, and the client cert unless the key needs `sslpassword`
In a container the cert files are mounted read only, and a missing one
fails before docker runs

> [!NOTE]
> a remote dump that only worked because verification was skipped now
fails. local targets and runs without TLS or timeout settings are
unchanged

<details>
<summary>visual rep:</summary>

```mermaid
flowchart TD
  conn["resolved connection"] --> remote{"remote target?"}
  remote -- no --> plain["host, port, user, password, database"]
  remote -- yes --> tls["+ sslmode and connect timeout<br/>+ root cert under require or verify-*<br/>+ system root cert forces verify-full<br/>+ client cert unless the key needs sslpassword"]
  tls --> where{"where pg_dump runs"}
  where -- container --> box["cert files checked, then mounted read only<br/>key copied to a private file<br/>verify-* without root cert, or system, uses the image CA bundle"]
  where -- native --> host["host paths kept<br/>verify-* without root cert uses ~/.postgresql/root.crt, else the host CA bundle<br/>system uses the host CA bundle"]
  plain --> dump["pg_dump"]
  box --> dump
  host --> dump
```

</details>

## ref

- spotted while working on: #7261
- related: CLI-2753