Explicit TLS configuration setup

[djc]

Extracts the parts of #1150 that don't rely on rustls 0.20 (now released) and the rustls-native-certs update (not yet done). Arguably should have done this sooner to avoid the rebase, but let's get it done now?

[Ralith]

Looks good overall; this definitely bites people on a regular basis.

Seems like there's two identically named commits for some reason?

[Matthias247]

I've only skimmed it.

So one of the gotchas with the previous configs was that some ::default() methods made rustls load TLS root certs from the system, which turned out to be very expensive (100ms+). Sometimes those even had not been used and where overwritten by custom config later on. Is this now better/worse/the-same with these changes?

[Ralith]

Is this now better/worse/the-same with these changes?

I think this is now the same or better. No ClientConfig is constructed by default, so servers will never try to load roots, and clients now have more explicit control in the form of calling with_native_roots or with_root_certificates.

[djc]

Seems like there's two identically named commits for some reason?

They're not identically named, one is for ClientConfig and one is for ServerConfig.

[Ralith]

It's pretty great how much code this saves, while simultaneously simplifying the API.

They're not identically named

Oops, reading is hard.

[Ralith]

Great stuff!