Enable TLS native root toggling at runtime

[charliermarsh]

Summary

It turns out that on macOS, reading the native certificates can add hundreds of milliseconds to client initialization. This PR makes --native-tls a command-line flag, to toggle (at runtime) the choice of the webpki roots or the native system roots.

You can't accomplish this kind of configuration with the reqwest builder API, so instead, I pulled out the heart of that logic from the crate (https://github.com/seanmonstar/reqwest/blob/e3192638518d577759dd89da489175b8f992b12f/src/async_impl/client.rs#L498), and modified it to allow toggling a choice of root.

Note that there's an open PR for this in reqwest (seanmonstar/reqwest#1848), along with an issue (seanmonstar/reqwest#1843), which I may ping, but it's been around for a while and I believe reqwest is focused on its next major release.

Closes #2346.

[zanieb]

Great work!

[zanieb]

Technically this is a breaking change, should we create a label for that and highlight accordingly?

[samypr100]

@charliermarsh Is it worth checking if SSL_CERT_FILE is set and make it behave as-if --native-tls was used?
I think that would keep this change backwards compatible with users leveraging SSL_CERT_FILE

e.g. something like

-let tls = tls::load(if self.native_tls {
+let tls = tls::load(if self.native_tls || env::var("SSL_CERT_FILE").is_ok() {
    Roots::Native
} else {
    Roots::Webpki
})

[charliermarsh]

We can support SSL_CERT_FILE even without --native-tls, I think. I'm happy to add that. It would effectively be this PR: #2351.

[samypr100]

Per this updated statement in the docs

If a direct path to the certificate is required (e.g., in CI), set the SSL_CERT_FILE environment
variable to the path of the certificate bundle (alongside the --native-tls flag), to instruct uv
to use that file instead of the system's trust store.

It sounds like reqwest will honor still SSL_CERT_FILE (if it's set), even if the loading is happening via on uv's end via tls::load/use_preconfigured_tls.
Assuming this, the suggested code snippet above would work to keep this change backwards compatible.