dx self-update fails with UnknownIssuer behind corporate TLS proxies (Netskope/Zscaler)

**Problem**

Running dx self-update fails with an UnknownIssuer error when behind a corporate proxy/firewall that performs transparent TLS inspection. This worked perfectly in version 0.7.3 but is broken in recent versions.

**Steps To Reproduce**

Run `dx self-update` in a system behind Netskope.

```bash
~> DIOXUS_LOG="trace" ~/.cargo/bin/dx self-update
0.01s TRACE checkout waiting for idle connection: ("https", api.github.com)
0.01s TRACE Http::connect; scheme=Some("https"), host=Some("api.github.com"), port=None
0.05s DEBUG connecting to 4.228.31.149:443
0.07s DEBUG connected to 4.228.31.149:443
0.10s TRACE checkout dropped for ("https", api.github.com)

ERROR dx self-update: Failed to fetch latest version

Caused by:
0: ReqwestError: error sending request for url (https://api.github.com/repos/dioxuslabs/dioxus/releases/latest)
1: error sending request for url (https://api.github.com/repos/dioxuslabs/dioxus/releases/latest)
2: client error (Connect)
3: invalid peer certificate: UnknownIssuer
```

**Expected behavior**

dx successfully updates itself

**Probable Root Cause**

In recent versions, default-features = false was added to reqwest and self_update in packages/cli/Cargo.toml.

By enforcing pure "rustls-tls", the CLI lost its native-tls (OpenSSL) backend fallback which used to read the OS trust store (update-ca-certificates). Pure rustls on Linux fails to discover these injected corporate CA certificates.

Since Cargo unifies features across the workspace, if self_update and the CLI resolve to compatible reqwest versions, self_update's internal client becomes isolated and blind to the system roots.

**Suggested Fix**

Explicitly add rustls-tls-native-roots to the reqwest dependency features in packages/cli/Cargo.toml (or the workspace root) to allow rustls to properly discover local system CAs:

```toml
# packages/cli/Cargo.toml
reqwest = { workspace = true, default-features = false, features = ["rustls-tls", "rustls-tls-native-roots", "json"] }
```

Note: If self_update resolves to an incompatible reqwest version preventing feature unification, consider switching self_update to use the default feature gate instead.

Note 2: If you plan to update self_update to 0.44.0, its reqwest and rustls features would probably be necessary instead.

**Environment:**

- Dioxus version: 0.7.9
- Rust version: 1.95.0
- OS info: Linux openSUSE-Tumbleweed in WSL (6.6.114.1-microsoft-standard-WSL2)

**Questionnaire**

I'm interested in fixing this myself but don't know where to start.