feat(rdp): RD Gateway transport (experimental)

RDP profiles can go through a Remote Desktop Gateway (MS-TSGU over an
HTTPS WebSocket) with its own username and password, stored like other
credentials (rdp-gateway-password). The gateway stream is bridged to a
loopback socket so the blocking RDP client uses it like any transport.

IronRDP's gateway crate (0.0.1) is vendored with fixes: it used
ironrdp-tls, which accepts any certificate, before sending Basic
credentials — the gateway is now verified against the web PKI; its
asserts on gateway-supplied lengths are errors instead of panics; and
the server port is passed through. Checked against a self-signed
openssl s_server: the connection is refused ('invalid peer certificate')
before any request or credential is sent. Not tested against a real
gateway; Basic-auth gateways only (no NTLM).

rust/core/src/validation.rs

@@ -334,6 +334,16 @@ pub fn validate_rdp_config(cfg: &RdpConfig) -> Result<(), ValidationErrors> {
         }
         t => errs.add("rdp.proxyType", format!("unsupported proxy type {t:?}")),
     }
+    if !cfg.gateway_host.trim().is_empty() {
+        let host = cfg.gateway_host.trim().rsplit_once(':').filter(|(_, p)| p.parse::<u16>().is_ok()).map_or(cfg.gateway_host.trim(), |(h, _)| h);
+        errs.check("rdp.gatewayHost", validate_host(host));
+        if cfg.gateway_username.trim().is_empty() {
+            errs.add("rdp.gatewayUsername", "the gateway needs a username");
+        }
+        if cfg.ssh_tunnel || !matches!(cfg.proxy_type.as_str(), "" | "none") {
+            errs.add("rdp.gatewayHost", "use a gateway, a proxy or an SSH tunnel — only one");
+        }
+    }
     let share = cfg.shared_folder.trim();
     if !share.is_empty() && !std::path::Path::new(share).is_dir() {
         errs.add("rdp.sharedFolder", "the shared folder must be an existing folder");