Use aws-lc-rs for rustls crypto provider

[malsamiri-oai]

Why

Some enterprise TLS proxies issue certificate chains signed with ecdsa_secp521r1_sha512 / ECDSA_NISTP521_SHA512. Custom CA configuration such as SSL_CERT_FILE can add the right trust root, but it cannot make rustls's ring verifier support a certificate signature algorithm it does not advertise.

That can still break TLS after the CA bundle is configured, including on Rust websocket paths that call the shared ensure_rustls_crypto_provider() helper, such as the Responses websocket connector and remote app-server client:

• codex-api/src/endpoint/responses_websocket.rs
• app-server-client/src/remote.rs

The aws-lc-rs rustls provider supports this P-521/SHA-512 certificate signature scheme, so use it as Codex's process-wide rustls provider.

What Changed

• Switch the workspace rustls feature from ring to aws_lc_rs.
• Update codex-utils-rustls-provider to install rustls::crypto::aws_lc_rs::default_provider().
• Add an assertion and integration test that the installed provider supports ECDSA_NISTP521_SHA512.

Verification

just fmt
just test -p codex-utils-rustls-provider
just bazel-lock-update
just bazel-lock-check

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8135b99cfc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[malsamiri-oai]

I have read the CLA Document and I hereby sign the CLA

[malsamiri-oai]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ecbee60436

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".