Add TLS (https) support

Design goal is: Make it secure by default and make it simple to do it right. At the same time don't patronize people who know what they are doing and want to disable certain security features.

# Server (API + bundled GUI)

* Two options `--tls` and `--no-tls` which enable and disable TLS.
* When listening exclusively to localhost / 127.0.0.1 then default to using no TLS
* When listening to any other IP default to using TLS
* More options `--tls-key` and `--tls-cert` which imply `--tls` to specify a specific certificate the user wants to use
* When using TLS without a specific certificate generate a new one and store it in the DB
* When starting the server always display the fingerprint of the current TLS certificate to make it easy to compare
* Maybe there should be a `cleosrv show tls-fingerprint` subcommand to display the fingerprint as well
* Implementation tips: https://eli.thegreenplace.net/2021/go-https-servers-with-tls/

# Client

* Add config options to trust specific TLS fingerprints for specific IPs / hosts. For example something like this:
```yml
tls-trusted-certs:
- host: localhost
fingerprint: 123412341234
- host: localhost
fingerprint: 456456456456
```
* If the certificate of the Cleodora server can't be trusted (e.g. it's not in the trusted CAs) then display the fingerprint along with the values that need to be added to the config to trust it. Ask yes / no whether to proceed and temporarily trust it anyway.
* Possibly useful: TOFU (Trust On First Use) library https://github.com/dhiltgen/golang-tofu
https://forfuncsake.github.io/post/2017/08/trust-extra-ca-cert-in-go-app/

# Notes

* When running only on localhost TLS just makes things more complicated without any benefit. Also it's possibly that the app is being run behind a reverse proxy that takes care of TLS, therefore default to not using TLS in this case (but allow overriding it of course)
* Without some sort of user authentication TLS does not make much sense. The scenario we are protecting against is snooping over the network where the user is. If the Cleodora server is reachable within that network and the server requires no authentication then any client can access it and does not need to bother trying to snoop unencrypted HTTP requests.

The issue does not name implementation files, tests, or entry points. Start by tracing the Go server and client startup and configuration handling, then determine how TLS, certificate storage, fingerprints, and trust prompts fit those paths. Done requires agreeing on the design and implementing the server and client behavior described in the issue with tests.

Written by the indexing model from the issue text.