refactor(fetch_tls): unify client identity configuration

[Kateřina Churanová (kate-shine)]

Summary

• represent key-material identities and rustls client-certificate resolvers with one internal ClientAuth state
• preserve the portable client_identity and rustls-specific client_identity_resolver APIs
• make repeated identity configuration predictable: the last builder call wins instead of the resolver silently taking precedence
• share configured key material through Arc so cloning TLS options does not duplicate private-key bytes

Validation

• fetch_tls formatting
• 71 crate tests
• Clippy across all targets and features with warnings denied
• API docs with no features and all features
• generated README and spelling checks

[Copilot]

Pull request overview

This PR refactors fetch_tls client-identity configuration by unifying in-memory key material (ClientIdentity) and rustls’ ResolvesClientCert into a single internal ClientAuth representation stored in shared TLS options. This makes repeated configuration deterministic (“last builder call wins”) while allowing TlsOptions to be cloned without duplicating private-key material.

Changes:

• Introduces internal ClientAuth (Identity(Arc<ClientIdentity>) / rustls-only Resolver(...)) and stores it in SharedOptions.
• Updates rustls backend build/configuration and builder API to read/write SharedOptions::client_auth (removing the rustls-backend-local resolver state).
• Updates native-tls backend to access client identity via a shared accessor, and refreshes tests to validate replacement semantics.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
crates/fetch_tls/src/rustls.rs	Switches rustls client-auth materialization to SharedOptions::client_auth and updates builder/tests for deterministic “last call wins”.
crates/fetch_tls/src/options.rs	Adds ClientAuth + client_auth to shared options, storing identities behind Arc and documenting replacement behavior.
crates/fetch_tls/src/native_tls.rs	Updates native-tls backend to read the shared client identity via SharedOptions::client_identity() and adjusts tests accordingly.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 91.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 99.9%. Comparing base (fa2de0c) to head (d57f0a2).
⚠️ Report is 26 commits behind head on main.

Files with missing lines	Patch %	Lines
crates/fetch_tls/src/options.rs	83.3%	1 Missing ⚠️

❌ Your project check has failed because the head coverage (99.9%) is below the target coverage (100.0%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #622     +/-   ##
========================================
- Coverage   100.0%   99.9%   -0.1%     
========================================
  Files         472     472             
  Lines       45447   45451      +4     
========================================
+ Hits        45447   45450      +3     
- Misses          0       1      +1     

Flag	Coverage Δ
linux	?
linux-arm	?
scheduled	?
windows	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.