net.http: add TLS termination to Server (HTTPS support)

[quaesitor-scientiam]

What

net.http.Server has been plain-HTTP only. This PR adds TLS termination so
an HTTP/1.1 server can listen on https:// directly, without a separate reverse
proxy. It is the prerequisite for landing server-side HTTP/2 (the next PR in the
series).

mut srv := &http.Server{
    addr:                   ':9043'
    cert:                   pem_cert_string   // or filesystem path
    cert_key:               pem_key_string    // or filesystem path
    in_memory_verification: true              // false when cert/cert_key are paths
    handler:                MyHandler{}
}
srv.listen_and_serve()

Files

File	Change
server.v	adds cert, cert_key, in_memory_verification fields; default_https_server_port = 9043; listen_and_serve delegates to listen_and_serve_tls when cert+key are set
server_tls_notd_use_openssl.v	mbedtls-based TLS listener + worker pool that serves HTTP/1.1 over TLS using the existing Handler contract
server_tls_d_use_openssl.v	matching stub for -d use_openssl: prints a clear runtime error, so the module still builds and existing plain-HTTP code keeps working
server_tls_test.v	hermetic round-trip test

Design

• Opt-in, additive. When cert / cert_key are unset, the existing plain
  TCP path is unchanged — no new code on that branch, same Handler contract,
  same workers.
• Backend gating via file suffixes. The mbedtls implementation lives in
  *_notd_use_openssl.v (default backend) and the matching stub in
  *_d_use_openssl.v reports a clear runtime error. This avoids pulling
  mbedtls into -d use_openssl builds that only used the OpenSSL client.
• No public-API break. The new fields are optional with safe defaults; the
  Handler interface is untouched.

Tests

server_tls_test.v spins up a local TLS Server with an in-memory
self-signed cert/key, exercises it via http.fetch(url, validate: false), and
asserts a 200 response body. Skips itself under -d use_openssl with a clear
message so the suite stays green there.

./vnew test vlib/net/http/server_tls_test.v                       # passes
./vnew -W -cstrict -cc clang test vlib/net/http/server_tls_test.v # passes
./vnew -silent test vlib/net/http/                                # 19 passed, 1 skipped (Windows)
./vnew -d use_openssl -silent test vlib/net/http/                 # 19 passed, 1 skipped

Notes / follow-ups

• OpenSSL server listener. The OpenSSL backend doesn't yet expose a
  server-side listener in net.openssl. The stub here reports a clear error;
  adding an OpenSSL listener (parallel to the mbedtls one in this PR) is the
  natural follow-up.
• Server-side HTTP/2. This PR is the prerequisite. The next PR adds ALPN
  on the TLS listener and an h2 path in the worker that demuxes streams onto
  the existing Handler.handle(Request) Response contract — again with no
  public-API change.

🤖 Generated with Claude Code