feat: implement HTTPS mTLS tunnel with auth handshake

Add HTTPS default tunnel endpoint and outbound connector using Rustls
with mTLS and an additional auth/session token.

- Add rustls, tokio-rustls, hyper, and related dependencies
- Implement TLS config builders (server/client) with cert validation
- Implement HTTPS tunnel listener with mTLS accept and auth handshake
- Implement HTTPS tunnel connector with server cert validation
- Add auth token loading from CLI value or file
- Add security gate state machine for tracking auth progression
- Fail closed for missing/invalid TLS config, cert mismatch, auth failures
- Port conflicts fail without fallback
- Reconnect revalidates all security gates
- 67 tests covering all validation assertions

Cargo.toml

@@ -19,6 +19,16 @@ x509-parser = "0.16"
 time = { version = "0.3", features = ["formatting"] }
 rand = "0.8"
 hex = "0.4"
+rustls = { version = "0.23", default-features = false, features = ["ring", "logging"] }
+rustls-pki-types = "1"
+rustls-pemfile = "2"
+tokio-rustls = "0.26"
+hyper = { version = "1", features = ["full"] }
+hyper-util = { version = "0.1", features = ["full", "server-graceful"] }
+http-body-util = "0.1"
+tower-service = "0.3"
+base64 = "0.22"
+sha2 = "0.10"
 
 [dev-dependencies]
 tempfile = "3"