[CLI] Require explicit CA for remote C++ REST connections

[ashutosh-agrawal]

Why

The C++ klish REST client may connect to either the default local REST server or a configured remote HTTPS endpoint. Remote connections should use a CA certificate selected specifically for that REST server while preserving the existing local workflow.

What

• Require REST_API_CA_CERT to identify a readable CA certificate file for every non-loopback HTTPS REST endpoint.
• Configure libcurl to verify the peer certificate and hostname using the selected CA file without falling back to its compiled-in CA directory.
• Preserve the current behavior for localhost, IPv4 loopback addresses (127.0.0.0/8), and IPv6 loopback (::1).
• Report a clear initialization error when the required CA configuration is missing or invalid.
• Add focused coverage for accepted and rejected endpoint classification and CA path validation.

This is the C++ client counterpart to #166. Operator-facing CLI configuration can be added separately.

How to verify

Run tools/test/rest-tls.sh to verify:

• localhost, IPv4 127.0.0.0/8, IPv6 ::1, and IPv4-mapped 127.0.0.0/8 endpoints are recognized as loopback.
• Remote, misleading, and malformed endpoint names are not recognized as loopback.
• Readable CA files are accepted, while missing paths, empty paths, and directories are rejected.

All tests passed.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[qiluo-msft]

(superseded by inline comments above)

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).