fix(gl-client): use webpki-roots for cross-platform LNURL TLS

[angelix]

Summary

rustls-tls-native-roots loads root CAs from the OS at runtime via the rustls-native-certs crate. On Android this reads /system/etc/security/cacerts/, which silently returns no certs on some Android variants (newer API levels, custom ROMs, apps without read access). When that happens, every HTTPS request from LnUrlHttpClearnetClient (gl-client/src/lnurl/models.rs:171) fails with:

error trying to connect: invalid peer certificate: UnknownIssuer

This breaks Lightning Address resolution and every LNURL flow on the affected configurations.

This PR switches to rustls-tls-webpki-roots, which compiles Mozilla's CA bundle into the binary. Identical behaviour on every platform, no runtime root-store discovery, no platform-specific code paths.

Trade-offs

• ✅ Cross-platform. Works on Android (any API level), iOS, desktop — no OS-specific cert-store quirks.
• ✅ No JNI / platform code. Standard reqwest config.
• ✅ Standard for Rust mobile SDKs. LDK, BDK, and most other Rust mobile libs ship this way.
• ⚠️ ~250 KB binary increase. Mozilla CA list compiled in. Acceptable for a mobile SDK.
• ⚠️ CA-bundle updates require an SDK release rather than following the OS. In practice CA changes affecting real-world LNURL servers are rare enough that this is a non-issue, and the previous behaviour was outright broken on the affected Android configurations.

Why not rustls-platform-verifier?

The modern best-practice for mobile is rustls-platform-verifier, which uses Android's KeyStore (via JNI), iOS's SecTrust, etc. But it requires reqwest 0.12+, and gl-client is pinned to ^0.11. Bumping reqwest is a much larger change with cascading dep updates and belongs in a separate PR.

Test plan

• cargo build -p gl-client — clean
• cargo build -p gl-sdk — clean (transitive consumer)
• Verify Lightning Address resolution succeeds on the previously-broken Android device (e.g. resolve someuser@walletofsatoshi.com)
• Smoke test on iOS and desktop to confirm no regression

Reference

Failure observed in production:

W com.blockstream.glsdk.Exception$Other: v1=error sending request for url
  (https://walletofsatoshi.com/.well-known/lnurlp/<user>):
  error trying to connect: invalid peer certificate: UnknownIssuer