upki: add feature fetch-native-tls

[djc]

cc @julian-klode

[codspeed-hq]

Merging this PR will not alter performance

✅ 4 untouched benchmarks

---

_{Comparing native-tls (ffaa96d) with main (a4bdeed)}

[ctz]

Just to record and note that use of openssl trashes upki fetch no-op performance.

rustls

$ /usr/bin/time target/release/upki fetch
0.09user 0.02system 0:00.14elapsed 78%CPU (0avgtext+0avgdata 20420maxresident)k
0inputs+160outputs (0major+3596minor)pagefaults 0swaps

==2220941==     in use at exit: 36,256 bytes in 12 blocks
==2220941==   total heap usage: 91,792 allocs, 91,780 frees, 56,390,142 bytes allocated

  Time (mean ± σ):     152.6 ms ±  24.7 ms    [User: 104.7 ms, System: 14.5 ms]
  Range (min … max):   141.8 ms … 251.1 ms    19 runs

OpenSSL 3.0.13 (as provided with Ubuntu 24.04)

$ /usr/bin/time target/release/upki fetch
0.09user 0.01system 0:00.18elapsed 61%CPU (0avgtext+0avgdata 23980maxresident)k
0inputs+160outputs (0major+3922minor)pagefaults 0swaps

==2220987==     in use at exit: 340,844 bytes in 6,295 blocks
==2220987==   total heap usage: 326,485 allocs, 320,190 frees, 62,661,282 bytes allocated

  Time (mean ± σ):     226.7 ms ±  19.8 ms    [User: 101.0 ms, System: 14.9 ms]
  Range (min … max):   146.1 ms … 240.0 ms    20 runs

Also worth noting that this removes PQC support, so Openssl is both 50% slower, uses 10x the memory, and doesn't actually do modern TLS 👍🏽

Let's not promote this option!

[djc]

To be fair, it might be slightly more modern on Ubuntu 26.04?

Interesting that the range is similar but the mean is substantially higher. Wonder what the distribution is like.