Add secure interactive Gemini TLS support

[mark-ik]

Summary

• present optional Gemini client certificates during TLS
• scope certificate trust pins to exact TLS targets, including non-default ports and IPv6 authorities
• preserve existing trust-store implementations with a source-compatible fallible pin hook
• stop before application bytes on first contact or certificate change

Verification

• gemini-protocol: 41 tests passed; 1 doctest passed
• package dry-run passed for the published crate
• published gemini-protocol 0.1.3 and 0.1.4; latest corrected release is 0.1.5