Verify hostname by default

This was disabled years ago while we were adding support for it,
but it has been working for some time now. This patch re-enables
hostname verification by default.

This addresses CVE-2025-46551 and GHSA-72qj-48g4-5xgx.

Users can work around this by applying this patch manually to their
own jruby-openssl and jruby installs, or by re-enabling hostname
verification with the following code early in application boot:

```ruby
require 'openssl'

OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:verify_hostname] = true
```

Author: headius

lib/openssl/ssl.rb

@@ -20,7 +20,7 @@ class SSLContext
       DEFAULT_PARAMS = { # :nodoc:
         :min_version => OpenSSL::SSL::TLS1_VERSION,
         :verify_mode => OpenSSL::SSL::VERIFY_PEER,
-        :verify_hostname => nil, # TODO => true needs JRuby support to call verify_certificate_identity
+        :verify_hostname => true,
         :options => OpenSSL::SSL::OP_ALL | OpenSSL::SSL::OP_NO_COMPRESSION
       }