schannel, use correct ssl configs

[icing]

When schannel operates in front of a proxy, it needs to use the proxy ssl configs, not the transfers ones. Choose the configs as it is done in other TLS backends.

[Copilot]

Pull request overview

This PR fixes Schannel’s selection of SSL/TLS configuration when the TLS connection is established “in front of” a proxy (HTTPS proxy / proxy TLS filter). It updates Schannel to pull the relevant SSL config from the active TLS cfilter (proxy vs origin), aligning Schannel with the connection-filter-driven configuration model used elsewhere in curl’s VTLS layer.

Changes:

• Update Schannel client-certificate loading to use Curl_ssl_cf_get_primary_config(cf) (proxy vs origin primary SSL config).
• Update certificate-info gathering (CERTINFO) decision in Schannel connect step 3 to use Curl_ssl_cf_get_config(cf, data) (proxy vs origin ssl_config_data).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jay]

This change makes it so that libcurl no longer saves the proxy cert info for schannel as the user-requested certinfo. I think that is correct but I'm not sure. Prior to this change the destination cert info would overwrite the proxy cert info, however if the destination was not a TLS connection then the proxy cert info would not be overwritten. The certificates saved for certinfo are from the last seen certificate chain but now this excludes proxy.

CURLOPT_CERTINFO doesn't say anything about proxy which is why I think this change is correct. However, I notice the OpenSSL backend seems to also save the proxy cert info (and then it is overwritten if the destination is a TLS connect as described above).

curl -v --write-out "%{certs}" --proxy-insecure -x https://localhost:8080 http://www.google.com -o NUL