chore(examples): refresh TLS dev dependencies

[divybot]

Summary

Refreshes the TLS example/dev dependency stack to current maintained rustls-family crates:

• tokio-rustls 0.24 → 0.26
• rustls-pemfile 1.0 → 2.2 (1.x is unmaintained per RUSTSEC-2025-0134)
• webpki-roots 0.23 → 1.0

Lockfile effect: drops the old ring 0.16 / rustls-webpki 0.100/0.101 / webpki-roots 0.23 line and brings in rustls 0.23, rustls-pki-types 1.x, rustls-webpki 0.103, and aws-lc-rs 1.17 (the default crypto provider in tokio-rustls 0.26).

API migration

The two TLS examples (examples/tls_client.rs, examples/tls_server.rs) are updated for the rustls 0.21 → 0.23 changes:

• ServerName now lives in rustls::pki_types.
• RootCertStore is built directly from webpki_roots::TLS_SERVER_ROOTS — OwnedTrustAnchor::from_subject_spki_name_constraints is gone.
• ClientConfig::builder() / ServerConfig::builder() no longer expose with_safe_defaults() — chain with_root_certificates(...).with_no_client_auth() directly.
• rustls_pemfile::pkcs8_private_keys / certs now return iterators of Result<PrivatePkcs8KeyDer<'static>> / Result<CertificateDer<'static>>. Collected with .collect::<std::io::Result<Vec<_>>>()?.
• The rustls::Certificate / rustls::PrivateKey newtypes are replaced by CertificateDer and PrivateKeyDer::Pkcs8 from rustls::pki_types.

The WebSocket library API is unchanged — only dev/example TLS plumbing is touched.

Test plan

• cargo build --locked --all-features --all-targets (compiles both examples and the rest of the workspace)
• cargo test --locked --all-features (lib + doc + trybuild + upgrade/concurrency/split tests pass)
• cargo fmt -- --check
• cd fuzz && cargo check --locked

Closes denoland/divybot#507