feat: support mTLS for remote database (#2638)

This PR adds mTLS (mutual TLS) configuration support for the LanceDB
remote HTTP client, allowing users to authenticate with client
certificates and configure custom CA certificates for server
verification.

---------

Co-authored-by: Claude <noreply@anthropic.com>

nodejs/__test__/remote.test.ts

@@ -3,7 +3,13 @@
 
 import * as http from "http";
 import { RequestListener } from "http";
-import { Connection, ConnectionOptions, connect } from "../lancedb";
+import {
+  ClientConfig,
+  Connection,
+  ConnectionOptions,
+  TlsConfig,
+  connect,
+} from "../lancedb";
 
 async function withMockDatabase(
   listener: RequestListener,
@@ -148,4 +154,88 @@ describe("remote connection", () => {
       },
     );
   });
+
+  describe("TlsConfig", () => {
+    it("should create TlsConfig with all fields", () => {
+      const tlsConfig: TlsConfig = {
+        certFile: "/path/to/cert.pem",
+        keyFile: "/path/to/key.pem",
+        sslCaCert: "/path/to/ca.pem",
+        assertHostname: false,
+      };
+
+      expect(tlsConfig.certFile).toBe("/path/to/cert.pem");
+      expect(tlsConfig.keyFile).toBe("/path/to/key.pem");
+      expect(tlsConfig.sslCaCert).toBe("/path/to/ca.pem");
+      expect(tlsConfig.assertHostname).toBe(false);
+    });
+
+    it("should create TlsConfig with partial fields", () => {
+      const tlsConfig: TlsConfig = {
+        certFile: "/path/to/cert.pem",
+        keyFile: "/path/to/key.pem",
+      };
+
+      expect(tlsConfig.certFile).toBe("/path/to/cert.pem");
+      expect(tlsConfig.keyFile).toBe("/path/to/key.pem");
+      expect(tlsConfig.sslCaCert).toBeUndefined();
+      expect(tlsConfig.assertHostname).toBeUndefined();
+    });
+
+    it("should create ClientConfig with TlsConfig", () => {
+      const tlsConfig: TlsConfig = {
+        certFile: "/path/to/cert.pem",
+        keyFile: "/path/to/key.pem",
+        sslCaCert: "/path/to/ca.pem",
+        assertHostname: true,
+      };
+
+      const clientConfig: ClientConfig = {
+        userAgent: "test-agent",
+        tlsConfig: tlsConfig,
+      };
+
+      expect(clientConfig.userAgent).toBe("test-agent");
+      expect(clientConfig.tlsConfig).toBeDefined();
+      expect(clientConfig.tlsConfig?.certFile).toBe("/path/to/cert.pem");
+      expect(clientConfig.tlsConfig?.keyFile).toBe("/path/to/key.pem");
+      expect(clientConfig.tlsConfig?.sslCaCert).toBe("/path/to/ca.pem");
+      expect(clientConfig.tlsConfig?.assertHostname).toBe(true);
+    });
+
+    it("should handle empty TlsConfig", () => {
+      const tlsConfig: TlsConfig = {};
+
+      expect(tlsConfig.certFile).toBeUndefined();
+      expect(tlsConfig.keyFile).toBeUndefined();
+      expect(tlsConfig.sslCaCert).toBeUndefined();
+      expect(tlsConfig.assertHostname).toBeUndefined();
+    });
+
+    it("should accept TlsConfig in connection options", () => {
+      const tlsConfig: TlsConfig = {
+        certFile: "/path/to/cert.pem",
+        keyFile: "/path/to/key.pem",
+        sslCaCert: "/path/to/ca.pem",
+        assertHostname: false,
+      };
+
+      // Just verify that the ClientConfig accepts the TlsConfig
+      const clientConfig: ClientConfig = {
+        tlsConfig: tlsConfig,
+      };
+
+      const connectionOptions: ConnectionOptions = {
+        apiKey: "fake",
+        clientConfig: clientConfig,
+      };
+
+      // Verify the configuration structure is correct
+      expect(connectionOptions.clientConfig).toBeDefined();
+      expect(connectionOptions.clientConfig?.tlsConfig).toBeDefined();
+      expect(connectionOptions.clientConfig?.tlsConfig?.certFile).toBe(
+        "/path/to/cert.pem",
+      );
+    });
+  });
 });