fix: address the use of InsecureSkipVerify in sample

[iennae]

Description

Addresses https://github.com/GoogleCloudPlatform/golang-samples/security/code-scanning/5

Checklist

• Please merge this PR for me once it is approved

in order for the sample to work, requires this to be set to true. Not a pattern we'd want to encourage in use so adding a comment to help encourage change when copied.

[enocom]

This is actual a symptom of Cloud SQL's public key infrastructure. By default, the Go TLS stack will attempt to verify the server's identity by inspecting the server's certificate. Because the server's certificate has a non-standard common name (e.g., myinstance:myproject), the verification will fail. Technically there is a pseudo DNS name in the server's certificate, but customers have to inspect their server certificate to know that value. If they knew that value, they could remove InsecureSkipVerify and add a ServerName field in the TLS config.

[iennae]

@enocom can you recommend a suggested update to the comment? :)

[enocom]

How about we move this comment to just above InsecureSkipVerify and say:

InsecureSkipVerify and a custom VerifyPeerCertificate function is required to handle Cloud SQL's custom certificates.
As an alternative it's also possible to inspect the server certificate and extract the SAN field and use that a ServerName
while removing InsecureSkipVerify and VerifyPeerCertificate.

It's not a great situation that Cloud SQL is working on fixing. Until then, the workaround is a headache.

[muncus]

this PR has been idle for a while, so i'm converting it to draft. Feel free to un-draft it when it is ready for review.