aws-util: migrate AWS SDK HTTP client to hyper 1.x + rustls/aws-lc-rs

[jasonhernandez]

Motivation

Final piece of the FIPS 140-3 crypto migration for the AWS SDK path. src/aws-util built its AWS SDK HTTP clients on the legacy hyper-0.14 stack with hyper-tls/native-tls (OpenSSL). This was the last native-tls consumer in our AWS SDK path.

This PR rebuilds those clients on the modern aws-smithy-http-client 1.1.12 Builder API using rustls with the aws-lc-rs crypto provider, matching the rest of the crypto stack.

• Completes the deviation flagged in crypto: switch HTTP clients from native-tls to rustls #35947.
• Prerequisite for the native-tls deny.toml ban staged in crypto: add deny.toml bans for old crypto deps #35952: hyper-tls@0.5.0 is now gone from the entire workspace, so the ban can land.

What changed

• http_client() and http_client_with_resolver() now use aws_smithy_http_client::Builder::new().tls_provider(tls::Provider::Rustls(CryptoMode::AwsLc)) and return SharedHttpClient via build_https() / build_with_resolver().
• MzAwsResolver now implements smithy's aws_smithy_runtime_api::client::dns::ResolveDns instead of tower_service::Service<Name>. It still delegates IP resolution to mz_ore::netio::resolve_address, preserving the SSRF protection: when enforce_external_addresses is set, private addresses are rejected. Only IP resolution is overridden; the SDK still uses the original hostname for SNI and TLS certificate validation.
• Manifests: dropped hyper-0-14, hyper-tls = "0.5.0", tower-service, and the now-unused direct aws-smithy-runtime dep from src/aws-util; added aws-smithy-http-client. Added aws-smithy-http-client = { version = "1.1.12", default-features = false, features = ["rustls-aws-lc"] } to the workspace deps.

Non-FIPS aws-lc-rs for now

We deliberately use the non-FIPS aws_lc_rs provider (rustls-aws-lc), consistent with the rest of the stack. A follow-up flips to rustls-aws-lc-fips once the NIST certificate lands.

Dependency tree: native-tls gone from aws-util

Before, mz-aws-util's direct dependencies included:

├── hyper v0.14.32
├── hyper-tls v0.5.0
├── tower-service v0.3.3

After:

├── aws-smithy-http-client v1.1.12
├── aws-smithy-runtime-api v1.12.1
├── aws-smithy-types v1.4.8
...

hyper-tls@0.5.0 no longer appears anywhere in the workspace, and hyper v0.14 is gone from aws-util's own subtree. aws-util's client path now resolves through rustls / hyper-rustls / tokio-rustls / aws-lc-rs / hyper v1.9.

Note: aws-util's transitive tree still contains native-tls/hyper-tls@0.6.0 via reqwest pulled by aws-config (and hyper 0.14 via aws-smithy-runtime's connector-hyper-0-14-x). That is out of scope for this PR: the point here is that aws-util's own HTTP client path no longer uses native-tls.

Cargo.lock

Re-resolved via cargo check -p mz-aws-util. No version bumps: the diff only flips aws-smithy-http-client's feature-selected deps (from the hyper-0.14 path to rustls) and updates aws-util's dependency edges.

Test plan

• cargo check -p mz-aws-util
• cargo check -p mz-aws-util --tests
• cargo check -p mz-storage -p mz-aws-secrets-controller (direct consumers of the SharedHttpClient return type)
• cargo test -p mz-aws-util --lib — all 3 resolver tests pass (rejects loopback when enforced, allows loopback when not enforced, allows public IP when enforced)
• bin/lint-cargo
• cargo --locked deny check licenses bans sources
• cargo fmt -p mz-aws-util

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ybr18V2N8x92CK641YAUUP

Part of SEC-217.