feat: Support custom CA bundle for corporate SSL inspection

[huseyinbabal]

Summary

Add support for AWS_CA_BUNDLE and SSL_CERT_FILE environment variables to allow taws to work behind corporate proxies with SSL inspection.

Closes #66

Problem

In corporate environments with SSL inspection, taws hangs or fails because:

• Proxy intercepts HTTPS traffic and re-signs with corporate CA
• Corporate CA is not in webpki-roots default trust store
• No way to configure custom CA certificates

Solution

New TLS Module (src/aws/tls.rs)

• Load CA certificates from AWS_CA_BUNDLE or SSL_CERT_FILE
• Support PEM files with multiple certificates (certificate chains)
• Cache certificates for application lifetime
• Configure all HTTP clients with custom CA and timeouts

Timeouts

• Connect timeout: 10 seconds (prevents hanging on TLS issues)
• Request timeout: 30 seconds

Updated Components

• src/aws/http.rs - Main AWS API client
• src/aws/sso.rs - SSO OIDC clients
• src/aws/credentials.rs - STS AssumeRole client

Usage

# Windows
set AWS_CA_BUNDLE=C:\path\to\corporate-ca-bundle.pem
taws

# Linux/macOS
export AWS_CA_BUNDLE=/path/to/corporate-ca-bundle.pem
taws

The PEM file can contain multiple certificates. This is the same environment variable used by AWS CLI, so if AWS CLI works with your CA bundle, taws should work too.

Testing

• Added unit tests for certificate parsing
• 73 tests pass
• Clippy passes

Notes

• If neither env var is set, default webpki-roots bundle is used (existing behavior)
• Warnings logged if CA bundle file is missing or invalid (falls back to default)
• IMDS and ECS container credentials don't use custom CA (local endpoints)