Add pluggable curb/Faraday HTTP client backends

[rubyjedi]

Replaces #32 — same content, rebuilt as a single clean commit (squashed and rebased onto current master) rather than continuing that branch's history.

Summary

• Makes the HTTP client backend pluggable (SOAP4R_HTTP_CLIENTS, mirroring the existing SOAP4R_PARSERS mechanism), adding curb and Faraday (typhoeus adapter) as opt-in backends alongside the existing httpclient/net_http.
• Broadens test coverage that used to be httpclient-only (backend-neutral wiredump parsing, SSL config coverage across all SSL-capable backends), fixing several real bugs surfaced in the process (Faraday :ciphers SSLOptions crash, URI.parse vs. already-a-URI object, curb Curl::Easy#ciphers= not existing, Tempfile finalizer bugs, Ruby 1.8.7 syntax regressions).
• Gates curb (>= 2.4, libcurl version requirement) and Faraday (>= 2.6, an enhancement for modern Rubies rather than a legacy capability — older Faraday releases don't match this project's adapter assumptions) to their real floors, with CI skipping cleanly below those floors instead of hard-failing.
• Fixes a latent CI bug where bundle config set with "..." (Bundler 2.x-only syntax) silently no-opped on the Bundler 1.17.3 every Ruby below 3.2 falls back to — curb/faraday were never actually being exercised in CI on those versions. Replaced with BUNDLE_WITH.
• Corrects an Ox dependency issue found via full-matrix regression testing: Ruby 2.2.x–2.6.x resolve Ox 2.14.14 unconstrained (Ox's own gemspec added a hard Ruby >= 2.7 floor starting at 2.14.15), and 2.14.14 segfaults inside Ox.sax_parse's :convert_special => true path on complex documents. htmlentities avoids that path entirely and is restored as a required dependency for that range; Ruby 1.9.3–2.1.x pins Ox exactly to 2.14.6 (decodes entities natively, no crash); Ruby 1.8.7 stays on the older Ox 2.4.5 (2.14.6 fails to build there).
• Adds CHANGELOG.md holding the full investigation detail (version-by-version Ox testing, Faraday's architecture mismatch, the BUNDLE_WITH bug, CI's Docker-per-version architecture, full known-test-exceptions writeup) that had accumulated as long inline comments in Gemfile, ci.yml, and README.md — those three files now carry short pointers instead.
• Scopes curb's already-documented libcurl/OpenSSL SSL exception on Ruby 2.4.10/2.5.9 to continue-on-error on just that step, instead of failing the whole job.

Test plan

• Full regression matrix (all 5 XML parsers × all applicable HTTP backends) re-run clean across 1.8.7, 1.9.3, 2.0.0, 2.1.10, 2.2.10, 2.3.8, 2.6.10 — all green except 1.8.7, which shows only its pre-existing, already-documented exceptions (see "Known Test Suite Exceptions" in README.md).
• ci.yml validated as syntactically correct YAML; Gemfile/lib/xsd/xmlparser/oxparser.rb validated as syntactically correct Ruby.
• GitHub Actions CI run on this PR (will run automatically once opened).