Freeze TLS dependency version

[svartalf]

Some specific version of native-tls should be used instead of git version:

unbound-telemetry/Cargo.toml

Lines 48 to 50 in 9618043

	[patch.crates-io]
	# Note: fuzzing crate has the same override
	native-tls = { git = "https://github.com/Goirad/rust-native-tls.git", branch = "pkcs8-squashed" }

Yet, native-tls does not support PCKS8 certificates, see sfackler/rust-native-tls#147

As an alternative, rustls can be used if it will be able to handle PCKS8 PEM files and communicate with unbound correctly. Additionally it will mitigate all these issues with building when you are required to have openssl dev files and so on.

[svartalf]

Side note: it seems hardly possible to use rustls instead of OpenSSL, since webpki crate thinks that certificates generated by unbound-control-setup are incorrect, probably due to some of these errors found by certlint:

$ ruby -I lib:ext bin/cablint /etc/unbound/unbound_control.pem
E: Old certificate version (not X.509v3)        unbound_control.pem
I: TLS Server certificate identified    unbound_control.pem
W: TLS Server certificates must include serverAuth key purpose in extended key usage    unbound_control.pem
E: BR certificates must be 825 days in validity or less unbound_control.pem
W: Certificate does not include authorityInformationAccess. BRs require OCSP stapling for this certificate.     unbound_control.pem
E: BR certificates must include certificatePolicies     unbound_control.pem
E: BR certificates must have subject alternative names extension        unbound_control.pem
E: commonNames in BR certificates must be from SAN entries      unbound_control.pem

$ ruby -I lib:ext bin/cablint /etc/unbound/unbound_server.pem
E: Old certificate version (not X.509v3)        unbound_server.pem
I: TLS Server certificate identified    unbound_server.pem
W: TLS Server certificates must include serverAuth key purpose in extended key usage    unbound_server.pem
E: BR certificates must be 825 days in validity or less unbound_server.pem
W: Certificate does not include authorityInformationAccess. BRs require OCSP stapling for this certificate.     unbound_server.pem
E: BR certificates must include certificatePolicies     unbound_server.pem
E: BR certificates must have subject alternative names extension        unbound_server.pem
E: commonNames in BR certificates must be from SAN entries      unbound_server.pem

webpki complains with BadDER error and rustls session fails with the following warning:

WARN  [rustls::session] Sending fatal alert DecodeError