http-api-client: T8955: enable TLS verification by default

ApiClientConfig.verify_tls defaulted to False and ApiClient unconditionally
silenced urllib3's InsecureRequestWarning, so TLS peer verification was off by
default. The sole consumer, src/op_mode/config_sync.py, builds the client
without passing verify_tls and therefore connected to a *remote* secondary VyOS
node over HTTPS without verifying the certificate -- a MITM exposure on the
channel that carries the API key and the full configuration.

- ApiClientConfig.verify_tls now defaults to True and accepts bool | str;
  a string is forwarded to requests as a CA bundle path (verify=<path>).
- InsecureRequestWarning is suppressed only when verification is explicitly
  disabled (verify_tls is False), not when a CA path or True is set.
- config_sync reads an optional verify_tls from the secondary runtime settings,
  defaulting to False to preserve current behaviour for self-signed secondaries.
  The insecurity is now explicit at the call site instead of hidden in the
  library default. Exposing a CA certificate (PKI reference) and peer
  fingerprint pinning under service config-sync secondary is follow-up T9396.

🤖 Generated by [robots](https://vyos.io)

0 files changed, 0 insertions, 0 deletions