Support SPP 9.0 TLS 1.3: consistent --http1.1 and opt-in TLS version pinning

[DanPeterson]

Closes #109.

SPP 9.0 enables TLS 1.3. safeguard-bash authenticates against 9.0 today, but HTTP-version pinning was applied inconsistently and there was no way to require a specific TLS version. This PR centralizes the curl plumbing and adds opt-in TLS enforcement.

Note: this replaces closed PR #111, which was accidentally opened from a branch pushed directly to upstream. This one is from my fork so it can take follow-up commits.

Changes

1. Shared curl helpers (src/utils/common.sh)

• _parse_curl_version / curl_version_ge — robust major.minor parse of curl --version. The old single-field parse read the minor digit (e.g. 5 from curl 8.5.0) and compared it against 33, silently dropping --http1.1 on curl >= 8.x. Same regression class fixed narrowly in A2A cert retrieval fails on curl 8.x: version parse drops --http1.1 (HTTP/2) #107, now fixed everywhere via one helper.
• set_http11_flag — sets --http1.1 when curl >= 7.33.
• set_tls_version_flags — maps SAFEGUARD_TLS_MIN / SAFEGUARD_TLS_MAX to --tlsvX.Y (floor) and --tls-max X.Y (ceiling), with input validation and a warning when --tls-max is unsupported (curl < 7.54).
• set_openssl_tls_args — best-effort -min_protocol / -max_protocol (or exact -tlsX_Y on older openssl) for the -O openssl s_client fallback paths.

2. Apply --http1.1 consistently on cert-auth / A2A paths

Client-certificate auth requires HTTP/1.1 (HTTP/2 forbids the post-handshake certificate exchange). Applied to:

• connect-safeguard.sh certificate RSTS grant (fixed the buggy parse).
• utils/a2a.sh invoke_a2a_method and get_a2a_connection_token (the SignalR negotiate call was previously missing it).
• listen-for-a2a-event.sh — all cert curls, including get_connection_token and negotiate_connection which never had it.
• Removed the dead + buggy parse copies in handle-a2a-{password,privatekey,apikeysecret}-event.sh.

Bearer/token requests keep the negotiated HTTP version.

3. Opt-in TLS version enforcement

SAFEGUARD_TLS_MIN / SAFEGUARD_TLS_MAX (values 1.0–1.3), threaded into every curl -K block and s_client fallback. Mirrors the min/max model proposed for the Python SDK (PySafeguard #41/#43). Default behavior is unchanged (negotiated, including TLS 1.3).

4. Docs + version

• Root README.md: new "TLS Version and HTTP/1.1 (SPP 9.0 / TLS 1.3)" section after "TLS Verification", including a curl gotchas for TLS 1.3 list (--tlsv1.3 is a minimum not exact; TLS backend must support 1.3; minimum curl versions for the flags; fail-fast validation; -O s_client mapping).
• src/README.md: short summary linking to the root section (kept minimal to avoid drift).
• pipeline-templates/global-variables.yml: version → 8.4.0.

Validation so far

• bash -n clean on all 9 edited scripts.
• Helper unit tests pass (curl 8.5 → --http1.1 set; min/max flag mapping; invalid input exits non-zero).
• Confirmed real curl accepts the generated -K config (--http1.1 / --tlsv1.2 / --tls-max 1.3).

Testing before merge (needs live appliances)

• curl 8.x against SPP 8.x: token auth (invoke-safeguard-method.sh) + cert/A2A retrieval.
• curl 8.x against SPP 9.0 (TLS 1.3): default connect + cert-auth + A2A retrieval succeed with no extra flags.
• SAFEGUARD_TLS_MIN=1.3 succeeds at 1.3; a sub-1.3 pin (SAFEGUARD_TLS_MAX=1.2) against 9.0 behaves as expected.
• Existing default behavior unchanged.

Opened as draft pending the live 8.x / 9.0 test pass.