ConnectionBuilder.TLSConfig option and Connection.Disconnect

[TopherGopher]

Part of the easymongo refactor (see PLAN.md on the refactor branch). Needed so easymongotest can connect to mongotest's TLS mode, and so tests can close connections cleanly.

Working context (read this first)

• Repository github.com/tophergopher/easymongo. Start from branch claude/mongotest-easymongo-refactor-wu2vhm; create a branch issue-<number>-<short-slug> from it and open a pull request back into it. PLAN.md on that branch is the source of truth; read it before writing code.
• Go project, single module, all packages at the repo root except the new easymongotest/ subpackage. The final toolchain target is Go 1.27 (set by Toolchain: go 1.27, latest dependencies, tidy, remove replace directives #10); any Go 1.24 or newer works until then. Before pushing: gofmt -l . prints nothing, go vet ./..., go test -race ./....
• The existing test suite (*_test.go at the root, package easymongo_test, every test function calling setup(t) from common_test.go) is the regression net for this refactor. It must pass after your change. It needs a Docker daemon reachable through the normal Docker environment and the mongo:8 image.
• Order matters. The driver package cannot compile half-migrated (the *mongo.Client type flows from Connection to Database to Collection), so the four driver issues Driver v2: migrate connect.go (mongo.Connect, Disconnect, BSONOptions, write concern) #2, Driver v2: options struct literals become builders; drop MaxTime; ArrayFilters and Delete option changes #3, Driver v2: primitive package merged into bson; replace x/bsonx in index.go #4 and Driver v2: Distinct returns a DistinctResult that must be decoded #5 land together in one pull request, worked in that order. Before them, New easymongotest subpackage wrapping mongotest/v2 #7 and Switch the easymongo test suite to easymongotest #8 must land so the test suite no longer depends on the old github.com/tophergopher/mongotest v0.1.0 module (which itself imports easymongo and breaks the moment easymongo's types change). Until mongotest's v2 module is tagged, use a local replace github.com/tophergopher/mongotest/v2 => ../mongotest/v2 in go.mod and say so in the pull request; Toolchain: go 1.27, latest dependencies, tidy, remove replace directives #10 removes it.
• Method is test-driven: write the tests listed under "Tests first", confirm they fail for the expected reason, then implement. Never delete, skip or weaken an existing test to get green; if a test must change because the public API changed (for example primitive.ObjectID to bson.ObjectID), change only the types.
• Driver v2 reference: https://pkg.go.dev/go.mongodb.org/mongo-driver/v2 and the migration guide https://github.com/mongodb/mongo-go-driver/blob/master/docs/migration-2.0.md. Signatures quoted in these issues were checked against v2.9.0.
• Do not add third-party dependencies unless this issue lists them.
• Tracking issue for the whole refactor: Tracking: easymongo refactor (mongo-driver v2, easymongotest helpers, toolchain) #13. The mongotest side is tracked in Tracking: mongotest refactor (stdlib Docker client, driver v1/v2 modules, lighter dependencies) mongotest#48.
• Commit messages: imperative summary line, blank line, body explaining why. Mention this issue number in the pull request description.

Scope

• func (cb *ConnectionBuilder) TLSConfig(cfg *tls.Config) *ConnectionBuilder storing the config in MongoConnectOptions and applying opts.SetTLSConfig(cfg) in clientOptions().
• Connection.Disconnect(ctx) error if not already landed by the connect.go migration issue; ensure it also clears the global connection when it was the cached one.
• Remove the large commented-out TLS block in connect.go (lines around 158-200) in favour of the real option.
• README: a short "Connecting with TLS" snippet.

Implementation details

Verified in v2.9.0: func (c *options.ClientOptions) SetTLSConfig(cfg *tls.Config) *options.ClientOptions and the resulting ClientOptions.TLSConfig *tls.Config field, which the unit test can read back. Add tlsConfig *tls.Config to MongoConnectOptions and apply it in clientOptions() after ApplyURI so it wins over any tls= URI parameter.

When both the URI contains tls=true and a config is given, the driver uses the config; when only the URI says tls=true, the driver uses system roots, which will fail against mongotest's self-signed CA. That is the failure the second integration test asserts (expect an error within the 2 second connect timeout, do not assert on the error text).

Tests first

• Unit: ConnectWith(uri).TLSConfig(cfg) results in clientOptions().TLSConfig == cfg.
• Integration (after easymongotest exists): connect to a mongotest.Run(t, mongotest.WithTLS()) instance with its Container.TLSConfig(); a plain connection to the same URI fails within the connect timeout.

Acceptance

• Both tests pass; the dead TLS comment block is gone.

Depends on: #8. Can land on driver v1 (the same SetTLSConfig exists there) before the driver migration pull request; Disconnect is then adjusted in #2.