dev: upgrade reqwest 0.11 -> 0.12 to deduplicate the HTTP stack

[sshaplygin]

Heads-up: this is a dependency upgrade, so it needs a maintainer's call. Happy to close it if you would rather schedule this differently.

Problem

reqwest 0.11 is built on hyper 0.14, so the dependency tree carried two parallel HTTP stacks — tonic's hyper 1.7 / http 1.3 / rustls 0.23 alongside reqwest's hyper 0.14 / http 0.2 / rustls 0.21. Downstream users compile, link and audit both.

Change

Bump reqwest to 0.12. No source changes are required: reqwest is used only for the two blocking token requests in credentials.rs, and its blocking API is unchanged between 0.11 and 0.12. The feature set (blocking, json, rustls-tls, default-features = false) is valid in 0.12 with the same meaning.

Effect on cargo tree -p ydb -e normal

• Crates present in more than one version: 22 → 9
• hyper 0.14 + 1.7 → 1.7; http 0.2 + 1.3 → 1.3; rustls 0.21 + 0.23 → 0.23; base64 0.21 + 0.22 → 0.22
• h2, http-body, tokio-rustls, rustls-webpki, webpki-roots, sync_wrapper, bitflags and core-foundation also collapse to a single version
• Total crates: 292 → 272

Risk checked

rustls 0.23 panics at runtime if more than one crypto provider is compiled in. Verified ring is still the only provider in the tree — no aws-lc-rs — and reqwest now shares tonic's single rustls 0.23 instance rather than configuring its own 0.21.

Because a provider fault surfaces only at request time, this was also confirmed with a temporary HTTPS smoke test built against the crate's exact feature resolution; it passed and was removed before commit.

Verification

cargo fmt --check && cargo clippy --workspace --all-targets --no-deps --exclude=ydb-grpc -- -D warnings
cargo test --workspace     # 214 passed, 88 ignored

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.86%. Comparing base (a6d7911) to head (2d39e8d).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #588      +/-   ##
==========================================
- Coverage   86.91%   86.86%   -0.06%     
==========================================
  Files         198      198              
  Lines       19492    19492              
==========================================
- Hits        16941    16931      -10     
- Misses       2551     2561      +10     

Flag	Coverage Δ
rust-1.88.0	86.85% <ø> (-0.06%)	⬇️
rust-1.96.1	87.15% <ø> (ø)
tests	86.86% <ø> (-0.06%)	⬇️
ubuntu	86.86% <ø> (-0.06%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[DXist]

+1

Old reqwest downgrades rustls-webpki to v0.101.7, which doesn't have webpki::anchor_from_trusted_cert, needed for TLS trust anchor configuration.

It's also possible to bump it to "0.13" if opentelemetry is installed from the current main branch. Done it here.