feat(rdp): RD Gateway transport (experimental)

RDP profiles can go through a Remote Desktop Gateway (MS-TSGU over an
HTTPS WebSocket) with its own username and password, stored like other
credentials (rdp-gateway-password). The gateway stream is bridged to a
loopback socket so the blocking RDP client uses it like any transport.

IronRDP's gateway crate (0.0.1) is vendored with fixes: it used
ironrdp-tls, which accepts any certificate, before sending Basic
credentials — the gateway is now verified against the web PKI; its
asserts on gateway-supplied lengths are errors instead of panics; and
the server port is passed through. Checked against a self-signed
openssl s_server: the connection is refused ('invalid peer certificate')
before any request or credential is sent. Not tested against a real
gateway; Basic-auth gateways only (no NTLM).

rust/core/src/secrets.rs

@@ -34,12 +34,13 @@ pub enum SecretKind {
     RdpPassword,
     RdpSshPassword,
     RdpSshPassphrase,
+    RdpGatewayPassword,
 }
 
 impl SecretKind {
     /// Every kind, so deleting a profile can purge them all from the keychain. A new variant
     /// must be added here as well as to `as_str`.
-    pub const ALL: [SecretKind; 15] = [
+    pub const ALL: [SecretKind; 16] = [
         Self::Password,
         Self::Passphrase,
         Self::Totp,
@@ -55,6 +56,7 @@ impl SecretKind {
         Self::RdpPassword,
         Self::RdpSshPassword,
         Self::RdpSshPassphrase,
+        Self::RdpGatewayPassword,
     ];
 
     /// The storage name, shared with the Go app.
@@ -75,6 +77,7 @@ impl SecretKind {
             Self::RdpPassword => "rdp-password",
             Self::RdpSshPassword => "rdp-ssh-password",
             Self::RdpSshPassphrase => "rdp-ssh-passphrase",
+            Self::RdpGatewayPassword => "rdp-gateway-password",
         }
     }