Add DTLS transport for newer Wi-Fi/LAN Kit-20 firmware

[botts7]

Newer Wi-Fi/LAN Kit-20 dongles (firmware released ~2024 onward — referred to in #117 and #121 as the "Cyber Security dongle") encrypt their local Modbus protocol with DTLS over UDP/8899. The standard WIFIKIT-214028-READ discovery probe to UDP/48899 returns dtls_port:8899 for affected hardware; plaintext requests on UDP/8899 are silently dropped, which is why UdpInverterProtocol times out against them without a useful diagnostic.

Empirically observed handshake parameters

• DTLS 1.2 negotiated by default with OpenSSL 3.0+ defaults (cipher ECDHE-RSA-AES256-GCM-SHA384). DTLS 1.0 also accepted.
• The dongle presents a self-signed placeholder certificate (CN=broker.goodwe-power.com), so peer verification must be disabled.
• Appears to accept only one concurrent DTLS session.

The application protocol is unchanged — Modbus RTU framing, slave 0xF7, identical register layout to existing inverter families. Responses carry the same AA55 prefix that validate_modbus_rtu_response already handles. Only the transport differs.

Implementation

• New goodwe/dtls.py with DTLSInverterProtocol, an async wrapper around pyOpenSSL's DTLS_METHOD driven by memory BIOs over a connected UDP socket. Reuses the existing command/decode infrastructure unchanged.
• Opt-in via a new dtls=True argument to goodwe.connect() (and the family classes). The goodwe.dtls module imports pyOpenSSL only on use, so the library still loads when the optional dependency isn't installed.
• Adds a [dtls] extra in setup.cfg (pip install goodwe[dtls]).
• Sessions are reused (keep_alive=True) so the ~1 s handshake is paid once per Inverter. Stale-response retries preserve the session; only genuine I/O errors tear it down.

inverter = await goodwe.connect(ip, family="ET", dtls=True)

Auto-discovery remains plaintext-only, so the family must be specified explicitly when dtls=True.

Tested — three inverters across two families

Inverter	Family	Reporter
GW10K-MS-30	MS (single-phase)	author
GW15K-ET-20	ET (three-phase)	@rnagler (#121)
GW10K-ET-20	ET (three-phase)	@adamsteen (#121)

Both ET-family users independently confirmed: discovery returns dtls_port:8899, and connecting with family="ET", dtls=True works where plaintext timed out.

Compatibility

• All 122 existing tests pass unchanged.
• 10 new tests in tests/test_dtls.py cover the async wrapper, retry/lock semantics, stale-response handling, and command-construction parity with the UDP path. They mock the blocking DTLS I/O; the real handshake is exercised by tests/manual_dtls_check.py (excluded from the standard run, needs hardware).

Open question

Happy to switch the dtls=True boolean to a transport= enum if you'd prefer that for forward-compatibility.

Closes #121
Possibly addresses #117, #95, #91