Configure HTTP client with system certificate pool for HTTPS requests

[Copilot]

The ChunkRunner uses http.DefaultClient for downloading/uploading chunks from source and destination URLs. This PR explicitly configures the HTTP client to use the system's trusted certificate chain.

Changes

• pkg/runner/chunk_runner.go: Added newHTTPClientWithSystemCerts() that clones http.DefaultTransport and configures TLS with x509.SystemCertPool(). Falls back to http.DefaultClient if system cert pool unavailable.
• pkg/runner/chunk_runner_test.go: Added tests verifying TLS configuration uses system certificate pool.

Implementation

func newHTTPClientWithSystemCerts() *http.Client {
    certPool, err := x509.SystemCertPool()
    if err != nil {
        klog.Warningf("Failed to load system certificate pool, using default: %v", err)
        return http.DefaultClient
    }

    transport := http.DefaultTransport.(*http.Transport).Clone()
    transport.TLSClientConfig = &tls.Config{
        RootCAs: certPool,
    }

    return &http.Client{Transport: transport}
}

Cloning http.DefaultTransport preserves connection pooling, timeouts, and proxy configuration while ensuring HTTPS requests validate certificates against the system trust store.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Supports the system's trusted certificate chain for client</issue_title>
<issue_description></issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Supports the system's trusted certificate chain for client #5

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.