1.2.0

HTTPS, served by the board

EthernetServerSecure and WebServerSecure — the same WebServer routes over
TLS. Mutual TLS too: requireClientCert(true) with a client CA, so the board
can refuse anyone without a certificate it trusts.

It is a build option, board_build.tls = mbedtls-server, because the server
half of mbedTLS is 45 KB of flash that a sketch fetching an HTTPS endpoint
never enters. The client-only board_build.tls = mbedtls is unchanged.

Verified on hardware against Python's ssl module — an implementation sharing
no code with mbedTLS — including the negative cases: a client trusting the
wrong CA is refused, a wrong hostname is refused, a client with no certificate
is refused under mutual TLS.

Link-time optimization, on by default

Worth 3–7% of flash: 2.2 KB off the smallest sketch, 24 KB off a TLS one.
board_build.lto = disabled turns it off, and the IDE has the same menu on the
same default.

Two bugs the new hardware tests found

HTTPClient truncated small responses to nothing. A body that arrived in its
own TCP segment just after the headers found the reader already gone: status
200, empty body. Large bodies were fine, which is what hid it.

WebServer leaked its client on every request. It deleted through a
Client*, and nothing in the Client/Stream/Print chain has a virtual
destructor, so no destructor ran at all.

Also

The Arduino IDE build gained a link-time-optimization menu, and TinyUSB's
buffers are now placed by section rather than by object filename — which is
what makes that placement mean the same thing under both build systems.
docs/hazards.md records what that investigation turned up: the belief that
this part's USB controller cannot reach DTCM, which this core was built around,
is not true.

382 tests: 109 host-side, 273 on hardware.