feat(bench-server): add TLS 1.3 with X25519 key exchange

- Generate self-signed certificates on startup using rcgen
- Configure rustls with aws_lc_rs crypto provider
- Filter key exchange groups to X25519-only for mode=x25519
- Print CA certificate for client trust configuration
- TLS 1.3 protocol enforced

Cargo.toml

@@ -8,17 +8,20 @@ authors = ["Kristofers Solo <dev@kristofers.xyz>"]
 edition = "2024"
 
 [workspace.dependencies]
+aws-lc-rs = "1"
 bench-common = { path = "bench-common" }
 claims = "0.8"
 clap = { version = "4.5", features = ["derive"] }
 miette = { version = "7", features = ["fancy"] }
 rcgen = "0.14"
 rstest = "0.26"
+rustls = { version = "0.23", default-features = false, features = ["std", "tls12", "aws_lc_rs"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 strum = { version = "0.27", features = ["derive"] }
 thiserror = "2"
 tokio = { version = "1", features = ["full"] }
+tokio-rustls = { version = "0.26", default-features = false, features = ["tls12"] }
 
 [workspace.lints.clippy]
 nursery = "warn"