Add transport-neutral TLS configuration

[samuel-williams-shopify]

Summary

• add transport-neutral TLS trust stores for custom and system-provided trust anchors
• represent trusted certificates and ordered local certificate chains as arrays of individual PEM strings
• add Certificates.parse for explicitly splitting concatenated PEM certificate bundles
• add TrustStore.parse and TrustStore.load conveniences
• add a TLS configuration for local certificate identity and peer verification policy
• expose an explicitly loaded OpenSSL adapter for compiling trust stores and complete TLS configurations
• integrate the abstract configuration with the SSL endpoint
• configure OpenSSL to verify certificate hostnames during verified client handshakes
• document the new TLS support and its suitability for future QUIC integration

The OpenSSL minimum-version change and removal of redundant SocketForwarder shims landed in #31 and are included through main.

Verification

• full suite: 100 tests, 185 assertions
• relevant TLS and SSL tests: 44 tests, 69 assertions
• SSL/TLS implementation files: 100% line coverage
• bundle exec rubocop: 46 files, no offenses
• bundle exec bake decode:index:coverage lib: 139/139 definitions documented