protect-ffi: apply the eMudhra SPKI blocklist to @cipherstash/stack's HTTP client #1305

Follow-up to #1301 / #1303, raised in review on #1303.

#1303 adds stack_auth::tls, a verifier around rustls-platform-verifier that refuses any presented certificate whose SPKI SHA-256 is one of the eight compromised eMudhra keys. It covers stack-auth's and stack-kms's bundled clients, which means @cipherstash/auth and stack-encrypt with http.

@cipherstash/stack on Linux is still exposed. languages/typescript/packages/protect-ffi pins stack-auth =0.42.3 and cipherstash-client =0.42.3 from crates.io. cipherstash-client (in cipherstash-suite) builds its own reqwest client with the unwrapped platform verifier. On Linux that verifier is webpki over the distro bundle with no revocation checking, and the Sectigo cross-signs keep the compromised intermediates trusted.

Steps

1. Release stack-auth with stack_auth::tls (it lands with fix(stack-auth): refuse TLS chains carrying the compromised eMudhra CA keys #1303).
2. In cipherstash-client (cipherstash-suite), build its reqwest client from stack_auth::tls::client_config(..), or an equivalent wrapper, and release it.
3. Move protect-ffi's stack-auth and cipherstash-client pins to those releases, and keep scripts/__tests__/cipherstash-client-parity.test.mjs passing (it ties the EQL workspace's pins to protect-ffi's).
4. Add an @cipherstash/protect-ffi / @cipherstash/stack changeset.

Close #1301 only once this ships.