s10: connection-string parser, TLS trust, timeouts, secret hardening, bulk & ergonomics

[MattJackson]

Tenth slice of the stack (stacked on #449 / stack/s9); each fix is its own commit referencing the issue it closes. Unit tests run in every feature lane; new integration coverage runs in the SQL Server lanes.

Security / credential hygiene

• Credentials stored as secrecy::SecretString — wrapped, zeroized, kept out of Debug.
• Unencrypted traffic despite encrypt=true due to TLS feature flags disablement #305 — no silent plaintext: on a no-TLS build, encrypt=true/strict now errors instead of quietly sending plaintext.

TLS / certificates

• Support configuring a CA certificates bundle and update to tokio-rustls 0.26.1 #290 + Add support for using Webpki roots with rustls to avoid relying on native certs #330 — unified trust config: additive trust_cert_ca (+ multi-cert files), new trust_cert_ca_bundle, and feature-gated trust_webpki_roots(); one loader across all three backends, fail-closed on zero usable certs.
• invalid peer certificate: UnsupportedCertVersion #327 — clearer rustls diagnostics for cert-version handshake failures.

Connection strings / config

• Error: Conversion error: Conversion error: Key-value pairs must be separated by a ; #313 — in-house ADO.NET connection-string parser (replaces the unmaintained connection-string crate for ADO): splits each pair on the first =, so base64/=-padded passwords parse; full special-char matrix + server-gated end-to-end login test. Parsed as an ADO.NET superset (see maintainer note).
• Connection Failure with MSSQL: Special Character Password #333 — actionable errors + docs for special-character passwords.
• When I connect to azure-sql-edge on macos, there is no response for a long time and the connection does not end, and there is no error reported #375 + Timeout when connecting to DB over VPN #360 — handshake_timeout and command_timeout so a stalled server surfaces a timeout instead of hanging.
• Error: UTF-16 error #325 — opt-in lossy UTF-16 decoding.

Ergonomics / bulk

• Creating a Row for a test case #383 — Row::builder().
• Bulk Copy Options #302 — bulk-copy options + column order hints.

Quality: internal-audit comment cleanups (no behavior change); unit tests green across the matrix; fmt + clippy (--features=all and no-default) clean; MSRV 1.88.

Note (maintainers): the #313 parser is an ADO.NET superset — it keeps {…} brace quoting as an extension. A separate note asks whether to go strict-ADO instead.

[MattJackson]

A heads-up on the connection-string parsing change in here (context: #313).

The connection-string crate we depend on looks unmaintained (0.2.0) and seems to diverge from ADO.NET on a fairly common case: it appears to reject an unquoted = inside a value, so base64/generated passwords with = padding don't parse. I've made a change to parse ADO strings ourselves, splitting each pair on the first = the way ADO.NET seems to. (JDBC still uses the crate for now.)

One thing worth a second opinion: I've made it a superset of ADO.NET — the documented ADO.NET rules, plus {...} brace quoting as an extension (the old crate supported braces, and we document/test them). The alternative would be strict ADO.NET, which would drop {...} braces (they're really an ODBC-ism, not SqlClient). Concretely, "strict" would change one thing: a value that begins with { is currently read as brace-quoted, whereas strict ADO.NET would treat the braces as literal characters.

I'd lean toward the superset since it seems backward-compatible and addresses #313, but I'm happy to go strict and drop braces if people prefer — wanted to flag it rather than decide it myself. We added tests across the special characters; it feels more solid, though I won't claim it's airtight.