Re-base fork onto upstream/main + REST SSL/TLS config

[mmaslankaprv]

What & why

Re-bases the redpanda fork onto Apache upstream/main (9bf1ba1b). The fork had branched from a pre-v0.3.0 upstream commit and accumulated 31 patches, most of which upstream has since re-implemented independently. Rather than a literal git rebase (a conflict storm over duplicate/obsolete work), this takes upstream/main as the new base and re-applies only the fork's one genuinely-unique, still-wanted feature: REST HTTP client SSL/TLS configuration.

Note: this is a large diff — it brings in ~140 upstream commits (SQL/Hive catalogs, Puffin, metrics, MOR deletes, streaming/S3 FileIO, upstream's own SigV4 + session-aware REST catalog, v3 types, …) on top of the fork's old base.

Carried over (the unique feature)

• REST SSL/TLS config: SslConfig{verify, ca_info, ca_path, crl_file} + SslConfigFromProperties() parser, applied via cpr::SslOptions on every request, threaded from catalog properties ssl.verify / ssl.ca-info / ssl.ca-path / ssl.crl-file at all three HttpClient construction sites. Secure by default (verify=true; disabled only on exact "false").
• CI: one SigV4 + REST build/test job (intentionally overlaps upstream's aws_test.yml).

Dropped (upstream supersedes)

• Fork's aws-crt-cpp SigV4 signer → adopt upstream's AWS-SDK SigV4 + session-aware catalog (feat(auth): implement SigV4 authentication for REST catalog apache/iceberg-cpp#616/feat(rest): add session-aware REST catalog apache/iceberg-cpp#750).
• Fork's OAuth2 token refresh → upstream (feat(rest): implement OAuth2 token auto-refresh for REST catalog apache/iceberg-cpp#646). Parquet metrics → upstream (feat: metrics for parquet writer apache/iceberg-cpp#651). Old Arrow ReadFile/WriteFile FileIO → upstream stream-handle FileIO. ref/ref-name assert fix → upstream (fix(rest): use "ref" field name for AssertRefSnapshotId requirement apache/iceberg-cpp#702).
• Conan packaging (conanfile.py) — dropped entirely; uses upstream CMake/Meson (SigV4 via -DICEBERG_SIGV4=ON, AWS SDK bundled).

Testing

rest_catalog_test passes 319/319 under a clean -Werror build (incl. 4 new SslConfigFromPropertiesTest cases); clang-format --dry-run --Werror clean on all touched files. Wire-level TLS (bad-cert rejection, custom CA) needs a live HTTPS server and is out of automated scope; the property→config→cpr mapping is unit-covered.

Design / plan

See docs/superpowers/specs/2026-07-01-rebase-fork-on-upstream-design.md and docs/superpowers/plans/2026-07-01-rebase-fork-on-upstream.md.

[bharathv]

@mmaslankaprv there are conflicts.

[mmaslankaprv]

resolved