fix(cli): present client certificates in --gateway-insecure mode

[zanetworker]

Summary

--gateway-insecure (OPENSHELL_GATEWAY_INSECURE=true) disables TLS server certificate verification but was also dropping client certificate presentation via .with_no_client_auth(). This broke mTLS gateways that require client certs — semantically, "insecure" should mean "skip server verification" (like curl -k), not "don't authenticate myself."

Related Issue

Fixes #2354

Changes

• Modified build_insecure_rustls_config to accept optional TlsMaterials — when provided, uses .with_client_auth_cert() instead of .with_no_client_auth()
• Updated both call sites (build_channel and http_health_check in run.rs) to attempt loading client certs from the gateway's mtls directory before building the insecure config
• Falls back to .with_no_client_auth() when certs are unavailable (no regression for non-mTLS setups)

Testing

Verified live against a local mTLS gateway:

# Before fix: "Client auth requested but no cert/sigscheme available"
# After fix:
OPENSHELL_GATEWAY_INSECURE=true RUST_LOG=debug openshell provider list 2>&1 | grep client
  Got CertificateRequest ...
  Attempting client auth    # <-- client certs now presented

• mise run pre-commit passes
• Unit tests added: insecure_config_without_materials_succeeds, insecure_config_with_materials_succeeds, insecure_config_with_invalid_cert_fails
• Live-tested against local mTLS gateway (Docker driver)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable — no behavioral contract change)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.