ycb_scylladb_cd45cb5a8595c

what a new run launched now would send

Today CQL authentication is either password-based or mTLS certificate-based, not both on one port. That forces a hard cutover: legacy password clients and certificate clients cannot share the same CQL endpoint during migration.

Add support so one CQL port can authenticate either way:
- If the client presents a trusted TLS client certificate, authenticate from the certificate (role via the existing auth_certificate_role_queries subject/SAN rules) without a SASL username/password exchange.
- If there is no client certificate (optional/request client-auth TLS, or a plain non-TLS CQL connection), fall back to normal username/password SASL authentication.
- If a certificate is presented, stay on the certificate path: do not fall back to password when certificate authentication fails (e.g. trusted cert whose subject matches no role query). Untrusted certificates should fail at TLS before password auth can rescue the connection.
- Make the feature selectable via the usual authenticator configuration (alongside the existing password and certificate authenticators), including any build/registration wiring those authenticators already need.
- Document how to enable it, emphasizing optional/request client auth rather than requiring a client certificate on every TLS connection (required mode would reject password-only clients at handshake).

Acceptance: same TLS port accepts successful cert-only and password-only clients; wrong password fails as auth (not as a bogus SSL error); plain port still does password auth; untrusted cert fails closed; cert present but unusable for role extraction does not silently succeed via password.

Interface contract — the change must expose exactly this surface:
Selectable authenticator short name CertificateOrPasswordAuthenticator and qualified name com.scylladb.auth.CertificateOrPasswordAuthenticator (same registration/config surface style as CertificateAuthenticator / PasswordAuthenticator).

Work only inside this repository checkout. Make the code change the task
describes, keeping the diff focused — no drive-by refactors.

When you are done, leave your changes committed or in the working tree;
they are collected automatically.

Stay on this snapshot checkout (`task/ycb_scylladb_cd45cb5a8595c`). Never checkout, pull, or rebase onto `main`. That branch is a README-only orphan.
Stay on this HEAD. Do not fetch another default branch. Push only on the Cursor-created `crazy-cursor/…` side branch from this HEAD.

Some past runs of this task were launched with a different prompt (the prompt template changed since, or those runs predate this benchmark's stored prompt). Each run persists the exact prompt it sent at launch — that per-launch record is the audit trail; this page shows only the current one.