buildAuthCertificatePinner

Builds the CertificatePinner scoped to the auth host(s) only.

Pinning is host-scoped by design: requests to non-auth hosts (map tiles, property metadata, positioning) are NOT pinned, so this single shared client keeps working for everything else even if an unrelated cert rotates. SSL/TLS failures (including a pin mismatch) surface as an exception on the call — the client never silently proceeds, and no permissive HostnameVerifier or trust-all TrustManager is installed.