test(mqtt): Mosquitto TLS+auth fixture + env-gated plain live suite

Adds the MQTT driver integration-test project: an eclipse-mosquitto fixture running
auth AND TLS (allow_anonymous false on both listeners), a mosquitto_pub-based JSON
publisher emitting retained messages, a cert/password generator script whose output is
gitignored, and a live suite gated on MQTT_FIXTURE_ENDPOINT that skips clean offline.

The fixture is never anonymous by design: an anonymous broker would let the driver's
TLS/CA-pin and auth paths go untested, and those fail silently. The CA-pin leg carries
its own falsifiability control (a foreign CA generated in-process must be rejected).

Live gate on 10.100.0.35: 7/7 passed. It found a driver defect, reported not fixed
here (src/ is out of this task's scope): MqttConnection.ConnectAsync RETURNS NORMALLY
when Mosquitto rejects a CONNECT as not-authorized -- MQTTnet 5 does not throw on an
unsuccessful CONNACK, so a wrong broker password yields DriverState.Healthy from
InitializeAsync. The auth-negative test therefore asserts the invariant that holds
either way (no session is ever established) and documents the finding.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/.gitignore

@@ -0,0 +1,14 @@
+# Fixture credential + TLS material produced by gen-fixture-material.sh.
+#
+# NEVER commit anything in here: it holds the broker password hash, the fixture CA's
+# PRIVATE key and the server's private key. The generator script is the artifact in
+# git; its output is regenerated per machine.
+secrets/
+
+# Belt-and-braces: catch key/cert material written directly into this directory by a
+# hand-run openssl command that forgot the secrets/ prefix.
+*.key
+*.crt
+*.csr
+*.srl
+passwd