Prevent OS certificate store fallback when CA pinning is enabled

[jeffreyparker]

Summary

• Prevent OS cert store fallback: When CA pinning is active (the default), sets CURLOPT_CAPATH to a non-existent randomized directory (/dev/null/<random>), preventing the TLS library from falling back to system-installed CA certificates. Fails closed with a RuntimeException if curl_setopt cannot apply the option (e.g., unsupported TLS backend).
• Remove FileRequester: The file_get_contents transport cannot provide equivalent CA pinning guarantees and ext-curl is already a hard requirement in composer.json, making it unreachable. Removing it eliminates a transport that could bypass pinning if injected.
• Normalize ca=IGNORE to disable_ca_pinning: The legacy ca="IGNORE" magic string is now normalized at the Client layer into the disable_ca_pinning flag, ensuring the User-Agent accurately reports ca_pinning=disabled and CurlRequester doesn't need awareness of the IGNORE convention.

Design Decisions

• /dev/null/<random> path: Uses a randomized suffix to prevent an attacker with filesystem write access from pre-creating the directory. On POSIX, /dev/null is a character device (subdirectories cannot exist), so this is belt-and-suspenders.
• Fail-closed RuntimeException: If CURLOPT_CAPATH cannot be set (exotic TLS backends that don't support it), the client throws rather than silently proceeding without the fallback protection.
• IGNORE normalization at Client layer: Rather than sprinkling ca="IGNORE" checks throughout CurlRequester, the Client entry point converts it to the canonical disable_ca_pinning flag. This keeps the requester logic simple and ensures reporting is always accurate.

Breaking Changes

• DuoAPI\FileRequester class has been removed. Users who directly constructed and injected this class will need to switch to CurlRequester (which was already the only reachable path via the default constructor since ext-curl is required).

Test plan

• Unit tests pass (75 tests, 123 assertions)
• SSL integration tests (require stunnel infrastructure)
• Verify on a system where CURLOPT_CAPATH is unsupported to confirm RuntimeException
• Verify ca="IGNORE" correctly reports ca_pinning=disabled in User-Agent