Get our TLS / X509 code audited

https://github.com/oxidecomputer/crucible/pull/182 introduces TLS between the Upstairs and Downstairs, and an X509 helper struct called TLSContext was introduced there. The config generation code uses "with_safe_defaults":

    pub fn get_client_config(&self) -> Result<ClientConfig, TLSContextError> {  
        Ok(ClientConfig::builder()                                              
            .with_safe_defaults()                                               
            .with_root_certificates(self.root_cert_store.clone())               
            .with_single_cert(self.certs.clone(), self.keys[0].clone())?)       
    }                                                                           
                                                                                
    pub fn get_server_config(&self) -> Result<ServerConfig, TLSContextError> {  
        let client_cert_verifier =                                              
            AllowAnyAuthenticatedClient::new(self.root_cert_store.clone());     
                                                                                
        Ok(ServerConfig::builder()                                              
            .with_safe_defaults()                                               
            .with_client_cert_verifier(client_cert_verifier)                    
            .with_single_cert(self.certs.clone(), self.keys[0].clone())?)       
    }

This seems like the right thing to do, but we should get this audited by someone with more knowledge about either TLS or the rustls crate or both.

Start with pull request 182 and trace the TLSContext implementation, especially get_client_config and get_server_config and their use of with_safe_defaults. Review the certificate, key, root store, and client-verifier handling against the relevant rustls and TLS guidance; done means documenting the audit findings and any required changes.