Filter and warn on invalid certificates (#18951)
Closes https://github.com/astral-sh/uv/issues/18890
Resolves the unexpected regression in 0.11 where `rustls-native-certs`
was previously performing filtering and switching to populating
certificates in reqwest ourselves resulted in stricter validation.
Follows https://github.com/astral-sh/uv/pull/18924 which added
pre-validation of certificates with better error messages. We retain
some of the error infrastructure for formatting a warning, but no longer
propagate it upward. We emit a log instead of a noisy user-facing
warning because they are often powerless to fix this and it's only
consequential if they attempt to communicate with a service that
requires the certificate (at which point, we'd just fail anyway).
Ideally, there's an upstream resolution in
https://github.com/rustls/webpki/issues/464 as we're still reading and
validating all of these certificates more than once.
