Authenticated HTTPS client wrapper for Eio (cohttp-eio's ~https hook)

Builds the Uri.t -> flow -> Tls_eio.t wrapper that cohttp-eio's client expects for its ~https hook: system CA bundle detection (via ca-certs), a Tls.Config.client, and the one-time Mirage_crypto_rng seed that TLS handshake needs before it can generate any key/nonce material. Extracted from four independent, byte-identical copies of this code (aws-eio's Aws_tls, obs-loki-eio's Obs_loki_tls, obs-prometheus-eio's Obs_prometheus_tls, and Sun's in-tree Kafka_service_tls) after an unseeded-RNG bug had to be hand-ported across all four. Not a general-purpose TLS or HTTP library — only the narrow wrapper cohttp-eio's ~https parameter needs.