Deprecate ssl_options in favor of ssl_context

[dkropachev]

Summary

Track deprecating the legacy ssl_options dictionary API in favor of passing an explicit ssl_context.

Motivation

ssl_options requires the driver to translate an ad hoc dictionary into runtime-specific TLS configuration across the connection layer and reactors. Recent SSL handling work in #938 had to preserve subtle behavior for omitted vs explicitly empty ssl_options, and also highlighted that the safer long-term API is to let callers provide a configured ssl.SSLContext directly.

Using ssl_context keeps TLS policy in the standard Python object, avoids reactor-specific option drift, and makes future TLS defaults easier to reason about.

Proposed deprecation path

1. Document ssl_context as the preferred TLS configuration API.
2. Mark ssl_options as deprecated in public docs and constructor/API references.
3. Add a runtime deprecation warning when ssl_options is supplied, while preserving existing behavior during the deprecation window.
4. Keep compatibility tests for legacy ssl_options behavior until removal is scheduled.
5. In a future major release, remove ssl_options support after a documented migration period.

Migration guidance

Users should build and pass an ssl.SSLContext with the desired CA certificates, verification mode, hostname checking, ciphers, and protocol bounds instead of passing ssl_options.

Related

Follow-up from #938.