minor: reduce flakiness in CI (#19706)

We have a few flaky tests in our own CI environment that fail (I've also seen failures in OSS).

1. I've observed that under a heavily-subscribed CI machine the KafkaIndexFaultToleranceTest.test_supervisorRecovers_afterChangeInTopicPartitions test can sometimes timeout under the current 120s limit. Increasing this to allow up to 240s has removed these failures for us.

2. Adjust the TLS tests to select ports that are not actually in-use. This should prevent any races that might occur from running tests at a higher concurrency in the future.

embedded-tests/src/test/java/org/apache/druid/testing/embedded/indexing/StreamIndexFaultToleranceTest.java

diff --git a/embedded-tests/src/test/java/org/apache/druid/testing/embedded/indexing/StreamIndexFaultToleranceTest.java b/embedded-tests/src/test/java/org/apache/druid/testing/embedded/indexing/StreamIndexFaultToleranceTest.java
index 89219c5..c315969 100644
--- a/embedded-tests/src/test/java/org/apache/druid/testing/embedded/indexing/StreamIndexFaultToleranceTest.java
+++ b/embedded-tests/src/test/java/org/apache/druid/testing/embedded/indexing/StreamIndexFaultToleranceTest.java
@@ -53,7 +53,7 @@
   @Override
   protected EmbeddedDruidCluster createCluster()
   {
-    return super.createCluster().useDefaultTimeoutForLatchableEmitter(120);
+    return super.createCluster().useDefaultTimeoutForLatchableEmitter(240);
   }
 
   @BeforeEach

server/src/test/java/org/apache/druid/server/initialization/JettyCertRenewTest.java

diff --git a/server/src/test/java/org/apache/druid/server/initialization/JettyCertRenewTest.java b/server/src/test/java/org/apache/druid/server/initialization/JettyCertRenewTest.java
index 6f29d1c..2f48f1f 100644
--- a/server/src/test/java/org/apache/druid/server/initialization/JettyCertRenewTest.java
+++ b/server/src/test/java/org/apache/druid/server/initialization/JettyCertRenewTest.java
@@ -27,6 +27,7 @@
 import com.google.inject.Module;
 import com.google.inject.multibindings.Multibinder;
 import org.apache.commons.io.IOUtils;
+import org.apache.druid.common.utils.SocketUtil;
 import org.apache.druid.guice.GuiceInjectors;
 import org.apache.druid.guice.Jerseys;
 import org.apache.druid.guice.JsonConfigProvider;
@@ -135,7 +136,11 @@
       throw new RuntimeException(e);
     }
 
-    final int ephemeralPort = ThreadLocalRandom.current().nextInt(49152, 65535);
+    // Pick ports that are actually bindable rather than guessing a random one: with reused forks and
+    // many concurrent test shards a blind random port frequently collides (BindException). Verify the
+    // plaintext and TLS ports independently since both are enabled below.
+    final int ephemeralPort = SocketUtil.findOpenPortFrom(ThreadLocalRandom.current().nextInt(49152, 60000));
+    final int tlsEphemeralPort = SocketUtil.findOpenPortFrom(ephemeralPort + 1);
 
     latchedRequestState = new LatchedRequestStateHolder();
     injector = Initialization.makeInjectorWithModules(
@@ -149,7 +154,7 @@
                 JsonConfigProvider.bindInstance(
                     binder,
                     Key.get(DruidNode.class, Self.class),
-                    new DruidNode("test", "localhost", false, ephemeralPort, ephemeralPort + 1, true, true)
+                    new DruidNode("test", "localhost", false, ephemeralPort, tlsEphemeralPort, true, true)
                 );
                 binder.bind(TLSServerConfig.class).toInstance(tlsConfig);
                 binder.bind(JettyServerInitializer.class).to(JettyServerInit.class).in(LazySingleton.class);