KUDU-3781: add TLS transport support for HMS client

With this patch, the Thrift client used for communication between
Kudu masters and Hive Metastore can protect its connections with TLS.

A few new flags have been introduced:
  --hive_metastore_tls_enabled (default: false)
  --hive_metastore_tls_trusted_ca_cert_file (default: "")
  --hive_metastore_tls_use_https_trusted_ca_cert (default: true)

If the latter is set to 'true', the trusted CA certificates are sourced
from the location where --trusted_certificate_file points to, i.e. the
same trusted CA information is used for HTTPS-based API connections
(KMS, JWKS, etc.) and HMS Thrift connections.  Otherwise, the trusted CA
certificate to validate HMS server certificate is sourced from the file
pointed to by the --hive_metastore_tls_trusted_ca_cert_file flag.

If no trusted CA certificates are provided for the Thrift HMS client,
the HMS server certificate must be verifiable using the system-wide
trusted CA certificate bundle.  Otherwise, TLS handshake between the
Kudu HMS client and the target HMS Thrift server fails, and the client
cannot talk to the HMS.

To provide proper handling of situations where the trusted CA
certificate file is absent or contains invalid data and satisfy the
requirements of HaClient high-availability wrapper, the HmsClient's
instantiation scheme changed to factory-based approach returning the
result instance allocated on the heap and wrapped into std::unique_ptr.
If the trusted CA certificate file is absent or contain invalid data,
HmsClient cannot be instantiated.

To cover the new functionality:
  * a few new scenarios are now present in hms_client-test.cc and
    a few are parameterized with TLS support enabled/disabled
  * most of scenarios in hms_catalog-test.cc
    are now parameterized with TLS support enabled/disabled
  * most of scenarios in master_hms-itest.cc
    are now parameterized with TLS support enabled/disabled

Change-Id: I9658323ed9aebdfdf8e6847c9c3129f5c8517c65
Reviewed-on: http://gerrit.cloudera.org:8080/24383
Tested-by: Alexey Serbin <alexey@apache.org>
Reviewed-by: Attila Bukor <abukor@apache.org>
Reviewed-by: Zoltan Chovan <zchovan@cloudera.com>