Affected: Maven: org.opensearch.plugin:opensearch-security

### Description

A regression was introduced in OpenSearch 2.18.0 that caused the `plugins.security.ssl.transport.enforce_hostname_verification` setting to be ineffective. When this setting was enabled, OpenSearch did not verify that the hostname in a connecting node's TLS certificate matched the hostname of the connection. This could allow a node with a valid certificate (signed by the cluster's trusted CA) but an incorrect hostname SAN to join the cluster.

### Impact

Clusters running affected versions with hostname verification enabled did not receive the expected protection from this setting. A node presenting a certificate signed by the cluster's trusted CA could join the cluster regardless of whether its hostname SAN matched. This regression does not affect certificate validation itself — only the additional hostname verification check.

### Patches

This issue is fixed in OpenSearch 2.19.4 and 3.3.0.

### Workarounds

Use more restrictive values for `plugins.security.nodes_dn` to limit which certificates are accepted for node-to-node communication.