Move self-signed certificate generation into the framework so callers don't
have to bring their own rcgen. `TlsConfig::self_signed(sans)` mints a fresh
self-signed cert (rcgen, behind the `tls` feature) for a backend hop whose peer
doesn't verify the chain (e.g. a load-balancer→task leg) — complementing the
existing `TlsConfig::from_pem`.

rcgen becomes an optional dependency gated on `tls` (was a dev-dependency for
the serve test, which now exercises the public helper instead). Bumps to 0.1.7.