fix(sdk): use bundled webpki roots for ICANN TLS instead of platform verifier

[jvsena42]

Problem

PubkyHttpClient builds its icann_http client with reqwest::Client::builder() and no explicit TLS config, so reqwest defaults to rustls-platform-verifier. On targets where that verifier isn't initialized — notably Android and iOS without the native verifier component — the first standard-TLS request panics:

panicked at rustls-platform-verifier-0.7.0/src/android.rs:90:
Expect rustls-platform-verifier to be initialized

Because the panic happens inside the background auth-relay polling task, the task is torn down, its channel sender drops, and the awaiting caller receives AuthError::RequestExpired. The visible symptom: Pubky Ring sign-in never completes on mobile — Ring approves successfully, but the requesting app errors out ~500 ms after start_auth_flow with "the provided auth request has expired or was cancelled", before approval even happens.

This was diagnosed end-to-end against a real device/emulator: Ring reaches the relay (it uses the OS HTTP stack), but the SDK's icann_http request to httprelay.pubky.app panics in the platform verifier.

Fix

Build icann_http with bundled webpki roots and an explicit ring CryptoProvider, via use_preconfigured_tls. This:

• works on every platform with no native verifier component and no process-default crypto provider (which is itself ambiguous when both ring and aws-lc-rs are in the tree);
• only affects ICANN-host TLS — pubky-host TLS still goes through pkarr's RawPublicKey verifier (ClientBuilder::from(pkarr)), unchanged.

Adds rustls (ring) and webpki-roots to the non-wasm deps.

Test

• Builds clean; the SDK compiles into a UniFFI Android library.
• Verified on an Android emulator: with this change, httprelay.pubky.app TLS succeeds, the relay poller stays alive, and a full Pubky Ring sign-in completes (token decrypted → session exchange → hydrated session). Without it, the verifier panic reproduces 100%.

🤖 Generated with Claude Code