feat(rdp): RD Gateway transport (experimental)

RDP profiles can go through a Remote Desktop Gateway (MS-TSGU over an
HTTPS WebSocket) with its own username and password, stored like other
credentials (rdp-gateway-password). The gateway stream is bridged to a
loopback socket so the blocking RDP client uses it like any transport.

IronRDP's gateway crate (0.0.1) is vendored with fixes: it used
ironrdp-tls, which accepts any certificate, before sending Basic
credentials — the gateway is now verified against the web PKI; its
asserts on gateway-supplied lengths are errors instead of panics; and
the server port is passed through. Checked against a self-signed
openssl s_server: the connection is refused ('invalid peer certificate')
before any request or credential is sent. Not tested against a real
gateway; Basic-auth gateways only (no NTLM).

rust/core/src/sessions/protocols.rs

@@ -315,12 +315,17 @@ impl Manager {
     ) -> Result<Arc<clients::rdp::Client>> {
         let timeout = Duration::from_secs(p.connect_timeout.max(1) as u64);
         let host = p.host.clone();
-        let dial: clients::rdp::Dial = match tunnel {
-            Some(t) => {
+        let gateway = (!rc.gateway_host.trim().is_empty()).then(|| rc.gateway_host.trim().to_string());
+        let dial: clients::rdp::Dial = match (tunnel, gateway) {
+            (_, Some(gw)) => {
+                let pw = self.secret_fn(id, &p.id, SecretKind::RdpGatewayPassword, rc.gateway_secret_mode, prompt.clone())()?;
+                clients::rdp::gateway_dial(gw, rc.gateway_username.clone(), pw, host.clone(), port)
+            }
+            (Some(t), None) => {
                 let h = host.clone();
                 Arc::new(move || t.open_tunnel(&h, port))
             }
-            None => {
+            (None, None) => {
                 let proxy = clients::proxy::Proxy {
                     kind: rc.proxy_type.clone(),
                     host: rc.proxy_host.clone(),