fix: use native root certificates for OIDC discovery

Switch reqwest from `rustls-tls` (embedded webpki/Mozilla roots only) to
`rustls-tls-native-roots` so the HTTP client reads system certificates
and honors the SSL_CERT_FILE environment variable. This is required on
OpenShift where the Keycloak route uses the cluster's ingress CA which
is not in the Mozilla root store.

Aligns with tokio-tungstenite which already uses rustls-tls-native-roots.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori

Cargo.toml

@@ -72,7 +72,7 @@ serde_yml = "0.0.12"
 apollo-parser = "0.8.5"
 
 # HTTP client
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots"] }
 
 # WebSocket
 tokio-tungstenite = { version = "0.26", features = ["rustls-tls-native-roots"] }