perf(deps): drop aws-lc-rs from non-FIPS builds, use ring backend

Bottlecap previously enabled `rustls/aws-lc-rs` directly AND pulled
ring transitively via `libdd-common/https`, so default builds
linked both crypto backends and shipped ~1.5 MiB of unused machine
code (aws-lc-sys alone is ~543 KiB stripped per cargo-bloat).

Switch to a single provider per mode:

  * default: ring (the libdatadog default — comes via
    libdd-common/https → rustls/ring + hyper-rustls/ring).
  * fips: aws-lc-rs (FIPS-validated — comes via rustls/fips +
    libdd-common/fips → hyper-rustls/fips).

Drops the hardcoded `aws-lc-rs` feature on the rustls direct dep and
makes the explicit `default_provider().install_default()` calls in
http_client.rs and trace_processor.rs cfg-conditional on the
bottlecap `fips` feature.

Verified via `cargo tree`:

  * `--features default`: ring ✓ pulled, aws-lc-rs ✗ absent
  * `--no-default-features --features fips`: aws-lc-rs ✓ pulled,
    ring ✗ absent

Production layer build (arm64, non-FIPS):

  bottlecap stripped: 11,709,896 → 10,137,032 B (−1,572,864 B, −13.4%)
  layer zip:           5,324,844 →  4,528,013 B (  −796,831 B, −15.0%)

Author: duncanista

bottlecap/Cargo.toml

@@ -40,7 +40,7 @@ hmac = { version = "0.12", default-features = false }
 sha2 = { version = "0.10", default-features = false }
 hex = { version = "0.4", default-features = false, features = ["std"] }
 base64 = { version = "0.22", default-features = false }
-rustls = { version = "0.23.18", default-features = false, features = ["aws-lc-rs"] }
+rustls = { version = "0.23.18", default-features = false }
 # Transitive via rustls. Pinned to >=0.103.13 so cargo audit passes (RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104).
 rustls-webpki = { version = "0.103.13", default-features = false }
 rustls-pemfile = { version = "2.0", default-features = false, features = ["std"] }

bottlecap/src/traces/http_client.rs

@@ -79,10 +79,16 @@ impl HttpClientTrait for HttpClient {
 /// Initialize the crypto provider needed for setting custom root certificates.
 fn ensure_crypto_provider_initialized() {
     static INIT_CRYPTO_PROVIDER: LazyLock<()> = LazyLock::new(|| {
+        // FIPS builds use the FIPS-validated aws-lc-rs provider, non-FIPS
+        // builds use ring (the libdatadog default). Pick based on the bottlecap
+        // `fips` feature so we never pull both crypto backends into the binary.
+        #[cfg(all(unix, feature = "fips"))]
+        let provider = rustls::crypto::aws_lc_rs::default_provider();
+        #[cfg(all(unix, not(feature = "fips")))]
+        let provider = rustls::crypto::ring::default_provider();
+
         #[cfg(unix)]
-        if let Err(_already_installed) =
-            rustls::crypto::aws_lc_rs::default_provider().install_default()
-        {
+        if let Err(_already_installed) = provider.install_default() {
             debug!(
                 "HTTP_CLIENT | Default CryptoProvider already installed, using existing provider"
             );

bottlecap/src/traces/trace_processor.rs

@@ -637,7 +637,10 @@ mod tests {
     #[allow(clippy::unwrap_used)]
     #[cfg_attr(miri, ignore)]
     async fn test_process_trace() {
+        #[cfg(feature = "fips")]
         let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
+        #[cfg(not(feature = "fips"))]
+        let _ = rustls::crypto::ring::default_provider().install_default();
         let start = get_current_timestamp_nanos();
 
         let tags_provider = create_tags_provider(create_test_config());