feat: add compliant TLS backend

[rhdedgar]

Summary

Adds an option to build with a FIPS-adherent TLS backend.

Note: rmcp's reqwest feature internally activates reqwest?/rustls, so it had to be removed from the workspace declaration and routed through the callout features instead. Without this fix, the native-tls build would silently include both TLS backends.

Closes #1219

[leseb]

P1 — Both TLS backends can silently compile together. apis/src/lib.rs rejects no backend, but not both. --features full,callout-native-tls succeeds and includes native TLS plus Rustls/AWS-LC—invalid for the intended FIPS graph. Add a mutual-exclusion compile_error!.

P2 — Azure AD can compile without any TLS backend. Removing workspace Rustls in Cargo.toml leaves azure-ad-filter with HTTP-only reqwest. The build succeeds, but its mandatory HTTPS token requests fail and produce 503s. Extend the backend requirement to Azure AD.

P2 — Native TLS has no functional handshake test. Makefile only runs cargo check and dependency-tree assertions. Neither this target nor the FIPS image exercises a callout through native TLS/OpenSSL. That misses #1219’s functional TLS acceptance criterion.

[rhdedgar]

Ack, I had initially put a check for zero TLS backend, but not both, that's a valid addition. I've added code in a new commit to address all 3 items, and the CI tests are passing now.

[leseb]

@rhdedgar can you check those two?

[MAJOR][Defect] Existing documented builds no longer compile
File: apis/src/lib.rs:16
Commands documented throughout examples/ omit the newly required backend.
Reproduced with --features openai-file-resolve-filter and --features gcp-adc-filter; both fail at the new guards.
Either preserve the default backend through feature wiring or update every supported command and example.

[MAJOR][Defect] Native test-utils profile is uncompilable
File: tests/utils/src/inference_fixture/mod.rs:35
callout-native-tls enables record.rs, which calls rustls-only use_rustls_tls().
Reproduction: cargo check -p praxis-test-utils --no-default-features --features callout-native-tls fails with E0599.

[rhdedgar]

Ok, tests are passing once again after pulling in the latest changes from main to avoid a merge conflict.

I've also added settings for the documented build configs so those issues don't slip by CI again.

Wire callout-rustls into the default feature for apis, filters, and server
so documented build commands like --features openai-file-resolve-filter
compile without an explicit TLS backend.
FIPS builds drop it cleanly with --no-default-features.