Separate HTTPS proxy TLS from origin TLS

[ryanfowler]

Summary

• Split HTTPS proxy dialing away from origin TLS config so proxy handshakes no longer inherit origin CA, mTLS, or --insecure settings.
• Keep proxy TLS on the default platform-verification path and pass no origin client auth into proxy connects.
• Update network tests to cover the proxy/origin TLS boundary directly.

Testing

• cargo fmt
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --all-features
• cargo test --all-features --test cli --test formatting --test grpc --test http --test network --test terminal --test update --test websocket -- --test-threads=1