feat(rdp): RD Gateway transport (experimental)

RDP profiles can go through a Remote Desktop Gateway (MS-TSGU over an
HTTPS WebSocket) with its own username and password, stored like other
credentials (rdp-gateway-password). The gateway stream is bridged to a
loopback socket so the blocking RDP client uses it like any transport.

IronRDP's gateway crate (0.0.1) is vendored with fixes: it used
ironrdp-tls, which accepts any certificate, before sending Basic
credentials — the gateway is now verified against the web PKI; its
asserts on gateway-supplied lengths are errors instead of panics; and
the server port is passed through. Checked against a self-signed
openssl s_server: the connection is refused ('invalid peer certificate')
before any request or credential is sent. Not tested against a real
gateway; Basic-auth gateways only (no NTLM).

rust/core/Cargo.toml

@@ -39,6 +39,7 @@ webpki-roots = "1"
 ironrdp = { version = "0.17", features = ["connector", "session", "graphics", "pdu", "svc", "dvc", "displaycontrol", "input", "cliprdr", "rdpsnd", "rdpdr"] }
 ironrdp-rdpsnd-native = { version = "0.7", default-features = false }
 ironrdp-blocking = "0.10"
+ironrdp-mstsgu = "0.0.1"
 x509-cert = { version = "0.2", default-features = false, features = ["std"] }
 
 [target.'cfg(unix)'.dependencies]