util: Fix AdvancedTlsX509KeyManager reloading credentials on every refresh

[TimurRakhmatullin86]

Problem

AdvancedTlsX509KeyManager's scheduled credential reloader reloads the key and certificates and rotates the TLS alias on every refresh interval, even when neither file has changed.

UpdateResult's constructor takes (boolean success, long certTime, long keyTime), but readAndUpdate builds it as:

return new UpdateResult(true, newKeyTime, newCertTime);   // args swapped vs the constructor
...
return new UpdateResult(false, oldKeyTime, oldCertTime);  // same swap

So result.certTime actually holds the key file's mtime and result.keyTime the cert file's mtime. LoadFilePathExecution.run() then stores each into the oppositely named field (currentCertTime = result.certTime, currentKeyTime = result.keyTime), so the persisted currentKeyTime/currentCertTime are crossed. On the next tick, readAndUpdate compares the key file's current mtime against the cert file's last-seen mtime and vice versa:

if (newKeyTime != oldKeyTime && newCertTime != oldCertTime) { ... reload ... }
// after the swap this is effectively (K != C && C != K), i.e. (K != C)

With two files whose mtimes differ — the normal case for a cert and a key written at different instants — K != C is always true, so it reloads every interval.

Impact

• Breaks the method's own documented invariant (comment: "We only update when both the key and the certs are updated.").
• Re-parses the private key and certificate chain from disk every refresh period for no reason.
• Rotates the key-<N> alias on every interval, continuously invalidating the per-alias encoded-key-material cache that the alias rotation (util: update AdvancedTlsX509KeyManager to support key alias for reloaded cert #12686) was introduced to enable — the opposite of the intended optimization.

Introduced by #11385, which reordered the UpdateResult constructor parameters but left these two call sites unchanged.

Fix

Pass the times in the order the constructor expects (certTime, keyTime).

Test

scheduledReload_doesNotReloadWhenFilesAreUnchanged gives the cert and key files distinct mtimes, schedules the reloader on a FakeClock, lets one refresh cycle run, then advances several more intervals with the files untouched and asserts the alias is unchanged. It fails before this change (expected:<key-2> but was:<key-3> — the alias keeps rotating) and passes after.