[sch-m]

By default lpac's HTTP backends do not verify the SM-DP+/SM-DS
server's TLS certificate or hostname, since some servers use
certificates issued by CAs that are not (yet) part of the GSMA CI
trust store shipped with common OS trust stores. This makes it
impossible to opt back into full verification even when the target
server's certificate is trusted.

Add environment variables to opt back into standard TLS verification
and to verify against a custom trust store, e.g. the GSMA CI
certificates:

LPAC_HTTP_SSL_VERIFY=1
LPAC_HTTP_TRUST_STORE=/path/to/bundle.pem

LPAC_HTTP_SSL_VERIFY accepts the usual boolean values (1, true, yes,
on, ...). LPAC_HTTP_TRUST_STORE is a PEM file with the CA certificates
to trust. If it is set, only these certificates are trusted (the
system trust store is not used), and verification is enabled unless
LPAC_HTTP_SSL_VERIFY is explicitly set to a falsy value. A trust store
that cannot be read makes the backend initialization fail.

When both are unset, behavior is unchanged for both backends
(verification disabled), preserving backward compatibility.

curl backend (driver/http/curl.c):

• When enabled, both CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST
  are set to enable verification (CURLOPT_SSL_VERIFYHOST is set to 2,
  matching curl's requirement that this option only accepts 0 or 2).
• With a trust store, CURLOPT_CAINFO is set to it and CURLOPT_CAPATH
  is cleared, since libcurl would otherwise still consult its default
  CA directory as well (e.g. /etc/ssl/certs on Debian/Ubuntu).
• libcurl's error buffer is printed when a request fails, so that
  verification errors can be told apart.
• The settings are read once in libhttpinterface_init() and applied to
  every request made via http_interface_transmit().

WinHTTP backend (driver/http/winhttp.c):

• When enabled, WINHTTP_OPTION_SECURITY_FLAGS is set to 0 instead of
  SECURITY_FLAG_IGNORE_UNKNOWN_CA, so the request goes through
  WinHTTP's standard certificate verification.
• With a trust store, its certificates are loaded into a memory store,
  which is used as exclusive root store of a certificate chain engine.
  WinHTTP keeps ignoring unknown CAs then, but only sends the request
  headers first: the server certificate chain (including validity,
  usage and hostname) is verified with that engine before the request
  body is written. HTTP redirects are not followed in this mode, like
  the curl backend never follows them.
• Same as the curl backend, the settings are read once in
  libhttpinterface_init() and applied via static variables in
  http_interface_transmit().

Both variables are documented in docs/ENVVARS.md.

[CoelacanthusHex]

IMO, I will want to expand it to WinHTTP backend as well and named it as LPAC_HTTP_SSL_VERIFY.

[sch-m]

IMO, I will want to expand it to WinHTTP backend as well and named it as LPAC_HTTP_SSL_VERIFY.

OK, I've renamed the option and added WinHTTP backend changes (untested) as well.

[septs]

Accept an externally specified trust store file.

A typical user story:

$ wget https://euicc-manual.osmocom.org/docs/pki/ci/bundle.pem
$ export LPAC_HTTP_TRUST_STORE=./bundle.pem
$ lpac profile download ...

[sch-m]

Accept an externally specified trust store file.

A typical user story:

$ wget https://euicc-manual.osmocom.org/docs/pki/ci/bundle.pem
$ export LPAC_HTTP_TRUST_STORE=./bundle.pem
$ lpac profile download ...

OK, I've added the optional trust store feature.

WinHTTP is still untested.

[septs]

@CoelacanthusHex please review