Authenticated HTTPS client wrapper and shared request helper for Eio

Builds the Uri.t -> flow -> Tls_eio.t wrapper that cohttp-eio's client expects for its ~https hook: system CA bundle detection (via ca-certs), a Tls.Config.client, and the one-time Mirage_crypto_rng seed that TLS handshake needs before it can generate any key/nonce material. Extracted from four independent, byte-identical copies of this code (aws-eio's Aws_tls, obs-loki-eio's Obs_loki_tls, obs-prometheus-eio's Obs_prometheus_tls, and Sun's in-tree Kafka_service_tls) after an unseeded-RNG bug had to be hand-ported across all four.

Also exposes request: a timeout-bounded, TLS-wrapped HTTP request built on cohttp-eio, factored out after obs-loki-eio, obs-prometheus-eio, kafka-eio-service, and sun-svc's JWKS fetch each independently rebuilt the same plumbing (validate URL, connect, apply ~https, send, read a bounded response body, classify timeout/network failures) on top of this package's own TLS wrapper. Not a general-purpose HTTP client — no retries, no connection pooling, no redirect handling; callers that need SigV4 byte-fidelity (aws-eio) or connection reuse still build their own transport.