feat(rdp): RD Gateway transport (experimental)

RDP profiles can go through a Remote Desktop Gateway (MS-TSGU over an
HTTPS WebSocket) with its own username and password, stored like other
credentials (rdp-gateway-password). The gateway stream is bridged to a
loopback socket so the blocking RDP client uses it like any transport.

IronRDP's gateway crate (0.0.1) is vendored with fixes: it used
ironrdp-tls, which accepts any certificate, before sending Basic
credentials — the gateway is now verified against the web PKI; its
asserts on gateway-supplied lengths are errors instead of panics; and
the server port is passed through. Checked against a self-signed
openssl s_server: the connection is refused ('invalid peer certificate')
before any request or credential is sent. Not tested against a real
gateway; Basic-auth gateways only (no NTLM).

rust/vendor/ironrdp-mstsgu/Cargo.toml.orig

@@ -0,0 +1,41 @@
+[package]
+name = "ironrdp-mstsgu"
+version = "0.0.1"
+readme = "README.md"
+description = "Terminal Services Gateway Server Protocol"
+edition.workspace = true
+rust-version = "1.89"
+license.workspace = true
+homepage.workspace = true
+repository.workspace = true
+authors.workspace = true
+keywords.workspace = true
+categories.workspace = true
+
+[lib]
+doctest = false
+test = false
+
+[features]
+default = []
+rustls = ["ironrdp-tls/rustls", "tokio-tungstenite/rustls-tls-native-roots"]
+native-tls = ["ironrdp-tls/native-tls", "tokio-tungstenite/native-tls"]
+
+[dependencies]
+base64 = "0.22"
+bitflags = "2.11"
+futures-util = "0.3"
+http-body-util = { version = "0.1" }
+hyper-util = { version = "0.1", features = ["tokio"] }
+hyper = { version = "1.9", features = ["client", "http1"] }
+ironrdp-core = { path = "../ironrdp-core", version = "0.2", features = ["std"] }
+ironrdp-error = { path = "../ironrdp-error", version = "0.2" }
+ironrdp-tls = { path = "../ironrdp-tls", version = "0.2" }
+log = "0.4"
+tokio-tungstenite = { version = "0.29" }
+tokio-util = { version = "0.7" }
+tokio = { version = "1.52", features = ["macros", "rt"] }
+uuid = { version = "1", features = ["v4"] }
+
+[lints]
+workspace = true