Is there any way for locking out sql_mode against client-side changes other than MySQL Proxy (which does not allow for SSL connections)? Perhaps some MariaDB-specific setting?
Unfortunately, we don't have such a feature yet.
However this feature would be trival to implement (about 3-4 hours of work including testing and adding to the MariaDB distribution) and thus is something that would be very suitable for a sponsorship.
I have added this feature request as WL#249