fix: make the minimum TLS version explicit

[sachaservan]

Explicitly require TLS 1.2 or newer in the synchronous socket wrapper and both pinned TLS contexts, addressing CodeQL #2 without changing certificate verification. Replace the substring-based rejection assertion with the exact expected error for #3.

Add regression coverage for TLS policy and secret-free fallback logging. Alert #1 remains unchanged: it flags the constant environment-variable name, not a secret value.

---

Summary by cubic

Makes the minimum TLS version explicit: the sync socket wrapper and both pinned SSL contexts now require TLSv1_2 or newer instead of relying on ssl.create_default_context() defaults, addressing CodeQL alert #2 without changing certificate verification. The transport origin-rejection test now asserts the exact error message instead of a substring, covering alert #3.

• Adds tests that enforce the TLS minimum and peer verification even when the default context is lax.
• Adds a test that the in-memory cache-secret fallback warning does not log the secret.
• Alert dep: update verifier version #1 remains unchanged: it flags the constant environment-variable name, not a secret value.

^{Written for commit b91f254. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>