Currently it's possible to specify both SessionBuilder.withCloudSecureConnectBundle and one of the programmatic SSL methods (withSslEngineFactory/withSslContext).
Throw an error instead, like we did for contact points.
Amend the Cloud manual section.
Note: we initially kept that possibility open in case some exotic case required a specific SSL configuration, but that seems unlikely. If the need arises, it's always possible to do it via a custom builder and/or context.