Bun parity: port fetch TLS matrix

Tracks copied Bun corpus position 4151 (js/web/fetch/fetch.tls.test.ts).

Scope:

• run the complete upstream TLS fetch matrix unchanged and isolate the first semantic gap
• port TLS listener/client behavior, certificate and connection lifecycle semantics required by the file
• preserve Bun-visible failures while attaching operation, phase, endpoint, cause, and composed stack context
• add a permanent focused regression and keep the ordered corpus frontier at zero failures/unsupported cases

Parent tracker: #66 Predecessor: #368

Completed in d85774431a191cd960c7bef190abec0a3fa640cf.

Ported the complete fetch TLS matrix:

• per-hop Host/SNI verification across cross-origin redirects
• trusted, self-signed, expired, and rejectUnauthorized: false certificate policy
• checkServerIdentity invocation, return/throw rejection, and rejection before request bytes are transmitted
• raw tls.createServer() HTTP round trips and ECONNRESET before response headers
• response-body timeout propagation with deadline-accurate elapsed time
• NODE_TLS_REJECT_UNAUTHORIZED and NODE_EXTRA_CA_CERTS subprocess behavior, including invalid mixed bundles
• structured TLS errors with code, operation, phase, endpoint, hostname, cause, and composed stack context

The broader replay also fixed two real prior-boundary gaps: 307/308 redirects now resend compressed transport bytes with matching headers, and omitted keepalive now emits the HTTP/1.1 keep-alive default while explicit keepalive: false still suppresses it.

Verification:

• upstream mirror is byte-identical to ~/Code/bun/test/js/web/fetch/fetch.tls.test.ts
• exact upstream file: 21 passed / 0 failed / 0 todo / 0 unsupported
• permanent focused regression: pass
• 49-file fetch tail: 1,399 passed / 20 todo / 0 failed / 0 unsupported
• fetch-compress.test.ts: 32/32
• fetch-connection-header.test.ts: 10/10
• fetch-keepalive.test.ts: 2/2
• zig build --cache-dir /private/tmp/home-zig-abi-cache: pass

Cumulative validated baseline segment through corpus position 4151: 492 files / 7,374 passed / 290 todo / 172 allowed-empty / 0 failed / 0 unsupported.

Parent tracker: #66 Predecessor: #368