Add --system-truststore option for OS trust store TLS verification

[andredlng]

Summary

Adds a global --system-truststore option (env ENTROPY_DATA_SYSTEM_TRUSTSTORE) that verifies TLS using the operating system's certificate trust store (macOS Keychain, Windows certificate store, Linux system CAs) instead of the bundled certifi CA list. This lets the CLI work behind a corporate TLS-inspecting proxy or with an internal CA whose root is installed in the OS trust store but not in the bundled list — the typical CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate situation.

When the flag (or env var) is set, the app callback calls truststore.inject_into_ssl() before any request, so it applies to every command that makes HTTPS calls. Certificate verification stays on; only the trust source changes.

This ports the feature just added to datacontract-cli (datacontract/datacontract-cli#1341), matching this repo's ENTROPY_DATA_ env-var prefix.

How it works

• New truststore>=0.10,<1.0 dependency (uv.lock updated).
• New inject_system_truststore() helper; missing-package case exits with a clear message.
• CHANGELOG entry under [Unreleased]; version bump left for the separate release commit.
• README: new "TLS behind a corporate proxy or internal CA" section.

Testing

uv run pytest (236 passed) and uv run ruff check .. Added tests/test_cli.py covering: the flag appears in --help, the flag injects, the env var injects, and no injection by default.