fix: keep the ssl options when DATABASE_URL carries sslmode

[Bccorb]

What

resolveSslOptions turns DB_SSL, or an sslmode on DATABASE_URL, into dialectOptions.ssl. Sequelize then reads the same sslmode for itself and merges pg-connection-string's reading of it over dialectOptions (the postgres branch of the URL constructor). With pg-connection-string 2.14 that reading is ssl: {}, so for a URL carrying sslmode the options were discarded and the certificate verified whatever DB_SSL or DB_SSL_REJECT_UNAUTHORIZED said. Against Amazon RDS, whose CA is not in Node's trust store, that is a boot failure. It also meant DB_SSL=false could not turn TLS off for such a URL, although resolveSslOptions and its test say it does.

Found in production on roxtarget-api, which shares this construction (fells-code/roxtarget-api#3); the same change is in fells-code/seamless-templates#91, fells-code/grand-cross-api#26 and fells-code/seamless-idea-api#145.

Nothing deployed is affected. Every stack hands the auth image the discrete DB_* variables plus DB_SSL=require, and the URL built from those never carries sslmode. Migrations are unaffected either way: config.cjs gives sequelize-cli discrete fields.

withoutSslMode in database.cjs (typed in database.d.cts) takes sslmode out of the string getSequelize constructs with, once resolveSslOptions has read it. Three tests, and the existing DB_URI test now asserts the stripped URL, which is the behaviour that changed. Patch changeset.

Checks

npm run typecheck, npm run lint, npm run format:check, npm run test:run (1468 tests) and npm run build pass.