TLS encryption channel

[viacheslauK]

TLS encryption channel

Summary

Adds an optional TLS-encrypted transport to the LT streaming client and server modules, with
server authentication, mutual TLS, and a mode that encrypts without authenticating the server.
daq.lt:// and daq.lts:// are supported side by side: the server can open plain and TLS listeners
simultaneously, and the client picks its mode from the connection-string prefix. Both channels
are advertised over mDNS and published as openDAQ server capabilities.

Changes

Transport and configuration

• WsStreamingServer gains the EnableTlsStreamingPort, TlsWebsocketStreamingPort,
  EnableMutualTls, CertificateFilePath, KeyFilePath and CaCertificateFilePath properties,
  and enables the plain and TLS listeners independently.
• WsStreaming maps daq.lts:// to wss:// and configures TLS from its own configuration
  object. WsStreamingDevice::createNewSecureType() and WsStreaming::createSecureType()
  register the daq.lts device and streaming types (OpenDAQLTStreamingSecure), with 7415 as
  the default port.
• The secure client configuration carries VerifyServerCertificate (default true). Cleared, it
  requires no CA, certificate or key, connects through wss::client::enable_tls_without_verification(),
  and logs a warning: the connection is encrypted but the server is not authenticated. Mutual TLS
  is hidden along with all three file paths.

Discovery and capabilities

• The client discovers _streaming-lts._tcp.local. alongside the existing services, and
  onCompleteServerCapability() accepts both OpenDAQLTStreaming and OpenDAQLTStreamingSecure,
  defaulting the port per scheme and building daq.lts:// connection strings for the secure one.
• WsStreamingServer::getDiscoveryConfigs() (plural) emits one record per enabled channel, and
  addCapability() publishes both with security levels 0 and 10. addCapability() now runs before
  the core-event subscription and the I/O thread start, with rollback on failure, and
  removeCapability() is guarded so a restarted server does not strip its successor's capability.

Error handling

• Certificate and key loading failures on both sides are translated to InvalidParameterException;
  a rejected handshake surfaces as AuthenticationFailedException (matched on the Asio SSL error
  category) and an unreachable peer as NotFoundException.
• WsStreaming tears the connection down on the I/O thread and disconnects its signal handlers
  there, rather than stopping the I/O context, which corrupted the ssl::stream during
  destruction.

Notes

• The unverified client mode is deliberately unauthenticated. It provides confidentiality only
  and no protection against an active man-in-the-middle. It is off by default and warns at
  connection time. Note that ws-streaming does not check the peer hostname against the certificate
  even in the verified mode, so a certificate from a trusted CA is accepted whichever host it was
  issued for.

[NikolaiShipilov]

LGTM 👍 . The only minor comment is about recognizing the cause of connection failure.