rust: use native-tls for the build-time CLI download

build.rs downloads the Copilot CLI with ureq, which was on the rustls
(tls) feature and pulled rustls, ring and webpki-roots into the build.
Switch ureq to native-tls and build the connector in build.rs so the build
no longer compiles rustls/ring (schannel on Windows, Security.framework on
macOS, OpenSSL on Linux).

ring is still in Cargo.lock: reqwest declares hyper-rustls as an optional
dependency and cargo keeps optional deps locked even when they are off, so
cargo tree -i ring is empty but the lock entry stays. This drops ring from
the build graph, not from the lockfile.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Shivam60

rust/Cargo.lock

@@ -93,5 +93,6 @@ dirs = "5"
 flate2 = "1"
 sha2 = "0.10"
 tar = "0.4"
-ureq = { version = "2", default-features = false, features = ["tls"] }
+ureq = { version = "2", default-features = false, features = ["native-tls"] }
+native-tls = "0.2"
 zip = { version = "2", default-features = false, features = ["deflate"] }

rust/Cargo.toml

@@ -596,7 +596,12 @@ struct DownloadError {
 }
 
 fn try_download(url: &str) -> Result<Vec<u8>, DownloadError> {
+    let connector = native_tls::TlsConnector::new().map_err(|e| DownloadError {
+        message: format!("native-tls init error: {e}"),
+        transient: false,
+    })?;
     let agent = ureq::AgentBuilder::new()
+        .tls_connector(std::sync::Arc::new(connector))
         .timeout_connect(Duration::from_secs(30))
         .timeout_read(Duration::from_secs(120))
         .build();