crypto: eliminate native-tls/OpenSSL/ring and unify on rustls/aws-lc-rs

[jasonhernandez]

Summary

Complete TLS migration from OpenSSL to rustls with aws-lc-rs as the sole crypto backend, enabling FIPS 140-3 compliance.

Changes by area

Core infrastructure

• mz-ore: crypto module with #[ctor::ctor] auto-install of aws-lc-rs CryptoProvider; split sentry into separate feature; switch async/tracing from openssl to rustls/hyper-rustls
• mz-tls-util: full rewrite from openssl to rustls (MakeRustlsConnect, RustlsTlsStream)

Server-side TLS

• pgwire-common, pgwire, server-core: tokio-openssl → tokio-rustls
• balancerd: hyper-openssl → hyper-rustls; LD SDK behind telemetry feature
• environmentd: rustls for HTTPS, rcgen for test certs, telemetry feature gating

Client-side TLS

• ccsr: reqwest rustls, improved TLS error handling
• persist: azure SDK with enable_reqwest_rustls_no_provider feature
• kafka-util, environmentd: rdkafka ssl-vendored → ssl-awslc
• fivetran-destination: openssl → aws-lc-rs/rustls for AES + postgres
• npm: reqwest rustls + sha2 → aws-lc-rs digest
• storage: sha2 → aws-lc-rs digest for upsert key hashing

Telemetry compile-time gating

• adapter, balancerd, environmentd: LaunchDarkly SDK and Segment behind telemetry feature (disabled in FIPS builds)
• LD SDK upgraded from 2.6.2 fork to upstream 3.0.1

Workspace forks

• azure-sdk-for-rust: mz/enable-reqwest-rustls-no-provider
• rust-sdk-transport: mz/aws-lc-rs-instead-of-ring
• rust-rdkafka: jasonhernandez/ssl-awslc
• mysql_async: rustls-fixes
• tiberius: rustls-0.23-on-mz-changes
• iceberg-rust: jasonhernandez/rustls-migration
• duckdb-rs: mz/rustls-tls-no-provider

deny.toml

• Ban native-tls, hyper-tls, openssl-sys, openssl-src, ring
• Ban sha2, hmac, subtle with wrappers for third-party crates

CI

• Docker builder: add Go + ninja-build + pre-built AWS-LC static library
• macOS agent: build AWS-LC for rdkafka ssl-awslc

Stack

1. crypto: fix crash on invalid mTLS certs in CREATE/ALTER CONNECTION #35894 — mTLS crash fix
2. crypto: migrate non-TLS crypto primitives from openssl/sha2 to aws-lc-rs #35895 — crypto primitives ← base
3. This PR — full TLS migration

Test plan

• cargo check / cargo check --all-features
• cargo deny check bans / cargo deny check licenses
• kafka-auth mzcompose tests (TLS error expectations updated)
• mysql-cdc TLS connection tests
• environmentd auth + server integration tests
• CI green

🤖 Generated with Claude Code

[github-actions]

Thanks for opening this PR! Here are a few tips to help make the review process smooth for everyone.

PR title guidelines

• Use imperative mood: "Fix X" not "Fixed X" or "Fixes X"
• Be specific: "Fix panic in catalog sync when controller restarts" not "Fix bug" or "Update catalog code"
• Prefix with area if helpful: compute: , storage: , adapter: , sql:

Pre-merge checklist

• The PR title is descriptive and will make sense in the git log.
• This PR has adequate test coverage / QA involvement has been duly considered. (trigger-ci for additional test/nightly runs)
• If this PR includes major user-facing behavior changes, I have pinged the relevant PM to schedule a changelog post.
• This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
• If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
• If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).