feat: send over TLS instead of plain TCP

[DavidCozens]

Wrap the byte stream in TLS, layered over the TCP stream from the previous stage. The device verifies
the collector against a trust anchor it already holds, so records can be read only by that collector
and cannot be altered in transit. The collector is authenticated to the device; the device is not yet
authenticated to the collector.

struct SolidSyslogMbedTlsStreamConfig tlsConfig = {
    .Transport  = SolidSyslogLwipRawTcpStream_Create(&tcpConfig),
    .Sleep      = SyslogSleep,
    .Rng        = DeviceCertStore_Rng(),
    .CaChain    = DeviceCertStore_CaChain(),
    .ServerName = SYSLOG_COLLECTOR_HOST,
};

.Stream = SolidSyslogMbedTlsStream_Create(&tlsConfig),

ServerName is checked against the collector's certificate, so it has to match a name that
certificate carries. The trust anchor and the DRBG are passed as handles rather than paths or PEM, so
the device's crypto is initialised before the scheduler starts.

A second concurrent session has to be paid for upstream. The mbedTLS allocator and the task that
carries the handshake both need sizing for it; both fail loudly when they are not, and neither can be
sized from the run that fails.

If your device does not already run TLS, the library and its trust material will dominate
everything on this page. This device already holds a TLS session for its own broker, so what this
stage adds is the adapter and a second session.

[coderabbitai]

Note

Reviews paused

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[DavidCozens]

@coderabbitai pause

[coderabbitai]

✅ Action performed

Reviews paused.

[DavidCozens]

@coderabbitai pause

[coderabbitai]

✅ Action performed

Reviews paused.