Last week Docksal switched from bookworm to trixie as their base.
See docksal/service-cli@63e34db

Bookworm was using MariaDB 10.11 for the client package while Trixie uses
MariaDB 11.8 for it. MariaDB at version 11.4 started defaulting to requiring SSL
for remote database connections.

See https://mariadb.com/docs/server/security/securing-mariadb/encryption/data-in-transit-encryption/securing-connections-for-client-and-server

With the db in a docker container even local development considers the db
to be remote. Thus requiring at least a self signed certificate for local
development as well as configuration to either ignore validation or to treat
the self signed certificate as valid.

Drush for doesn't honor flags disabling ssl in ~/.my.cnf or /etc/mysql/my.cnf
as far as I can tell and drush-ops/drush#6355 seems
to validate. So this seems to be the best way to disable requiring SSL.

Picked up this config from lagoon images.
https://github.com/uselagoon/lagoon-images/pull/1276/changes
https://github.com/uselagoon/lagoon-images/blob/main/images/php-cli-drupal/drush.yml

Testing seems to show that older versions of Drush ignores the options
they aren't familiar with. At least 12.5.3.0 does.