fix(tls): use OS certificate store for corporate SSL inspection

[icebear0828]

Summary

• Switch reqwest feature from rustls-tls (bundled webpki-roots) to rustls-tls-native-roots (reads OS certificate store)
• Corporate CAs (Cloudflare Access, Zscaler, etc.) are now trusted automatically without manual config
• TLS fingerprint unchanged — ClientHello determined by pinned rustls 0.23.36, not root CA source

Closes #598

Test plan

• cargo check — compiles cleanly
• cargo build --release — native addon builds
• npm test — 239 files / 2356 tests pass, zero regression
• Manual: verify with Cloudflare Access / corporate SSL inspection environment

[FlavienKlr]

Tested on Windows 11 behind Cloudflare Access (Zero Trust Traffic & DNS mode) with corporate Gateway CA - Cloudflare Managed G1, fix works perfectly. ✅

Before: Every upstream request failed with invalid peer certificate: UnknownIssuer (webpki-roots missing the
corporate CA).

After: rustls-tls-native-roots picks up the CA from the Windows cert store immediately. No config changes needed

One note for other enterprise users: if you build from source behind Cloudflare Access, you may need:

• NODE_EXTRA_CA_CERTS pointing to your corporate cert for npm install
• CARGO_HTTP_CHECK_REVOKE=false for cargo build (schannel revocation check can fail with corporate proxy inspection)

Thanks for the quick turnaround!