fix(rdpeudp): harden TLS sideband setup

[Marc-André Moreau (mamoreau-devolutions)]

Extract the reusable rustls verifier/client-config builder out of ironrdp-tls into a new rustls_verifier module (gated behind a rustls-verifier feature) so the RDPEUDP2 reliable-UDP TLS sideband can share the same certificate validation policy and callback semantics as the primary TCP transport, without pulling in a specific TLS stream backend.

ironrdp-rdpeudp-tokio now depends on ironrdp-tls (rustls-verifier only) and gains a UdpTlsConfig type covering certificate validation mode, callback, and endpoint. The synchronous validation callback runs on a blocking-pool thread with a nested current-thread runtime so it cannot starve the current-thread RDPEUDP driver. TLS handshake and RDPEMT tunnel establishment are now wrapped in bounded timeouts (tls_timeout, tunnel_timeout) with dedicated error kinds.

The Driver gains a Drop impl that closes SharedIo and wakes parked readers when the stream was not already released, so aborting or dropping a connection attempt cannot strand a blocking-pool thread or leave detached TLS work parked forever.

MultitransportBootstrap::connect now takes the TLS config directly instead of an optional raw verifier, and its docs clarify that S_OK is only sent once Soft-Sync has been negotiated.

This is an independent split extracted from draft #1777, targeting master directly (no stacking). It is the second of the split PRs from that source.

Scope

Included:

• crates/ironrdp-tls/{Cargo.toml,src/lib.rs,src/rustls.rs} + new src/rustls_verifier.rs
• crates/ironrdp-rdpeudp-tokio/{Cargo.toml,README.md,src/lib.rs,src/multitransport.rs,src/tls.rs,src/transport.rs,src/error.rs,src/driver.rs}
• crates/ironrdp-testsuite-extra/tests/rdpeudp_tokio.rs (RDPEUDP-specific test updates only)
• Cargo.lock regenerated to add the single new ironrdp-rdpeudp-tokio -> ironrdp-tls dependency edge

Deliberately excluded (client/connector-dependent, out of scope for this slice):

• crates/ironrdp-testsuite-extra/Cargo.toml — the source PR's "udp" feature addition applies to the ironrdp-client dev-dependency, which doesn't exist without the client-side UDP wiring landed in a separate PR
• crates/ironrdp-testsuite-extra/tests/client/config.rs — the reliable_udp_is_opt_in test depends on ironrdp-connector::ConfigBuilder::with_udp_transport, out of scope for this slice

Validation

• cargo build -p ironrdp-tls -p ironrdp-rdpeudp-tokio
• cargo check --workspace --all-targets (confirms no other crate references the removed APIs)
• cargo test -p ironrdp-testsuite-extra --test integration_tests_extra rdpeudp_tokio:: — 12/12 passed
• cargo test -p ironrdp-rdpeudp-tokio --features rustls-ring — 51/51 passed
• cargo check -p ironrdp-tls across rustls-verifier, stub, native-tls, rustls-no-provider feature combos
• cargo xtask check fmt -v, cargo xtask check lints -v, cargo xtask check locks -v, cargo xtask check typos -v — all passing

[Copilot]

Pull request overview

Hardens RDPEUDP2 TLS sideband setup by sharing certificate validation with the primary transport, bounding connection phases, and improving cancellation cleanup.

Changes:

• Extracts a reusable rustls verifier/configuration feature.
• Adds UDP TLS configuration, callback isolation, and handshake timeouts.
• Ensures dropped drivers wake blocked I/O and expands integration coverage.

Dedicated prose reviewers were skipped due to the five-skill limit; documentation was reviewed directly.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Cargo.lock	Records the new TLS dependency edge.
crates/ironrdp-tls/Cargo.toml	Adds the verifier-only feature.
crates/ironrdp-tls/src/lib.rs	Exports the shared rustls builder.
crates/ironrdp-tls/src/rustls.rs	Reuses shared TLS configuration.
crates/ironrdp-tls/src/rustls_verifier.rs	Implements certificate verifier construction.
crates/ironrdp-rdpeudp-tokio/Cargo.toml	Adds verifier-only TLS dependency.
crates/ironrdp-rdpeudp-tokio/README.md	Documents supported transport and strict validation.
crates/ironrdp-rdpeudp-tokio/src/driver.rs	Closes shared I/O when dropped.
crates/ironrdp-rdpeudp-tokio/src/error.rs	Adds TLS and tunnel timeout errors.
crates/ironrdp-rdpeudp-tokio/src/lib.rs	Exports UdpTlsConfig.
crates/ironrdp-rdpeudp-tokio/src/multitransport.rs	Forwards sideband TLS policy.
crates/ironrdp-rdpeudp-tokio/src/tls.rs	Runs callback handshakes off-runtime.
crates/ironrdp-rdpeudp-tokio/src/transport.rs	Applies TLS and tunnel timeouts.
crates/ironrdp-testsuite-extra/tests/rdpeudp_tokio.rs	Tests callbacks, current-thread operation, and cleanup.