RFE: Backend outbound HTTP/2 and client-certificate authentication #5990

The native Web client is backed by libcurl, but its public API does not expose client-certificate authentication or protocol requirements. The musl packaging configuration builds curl without nghttp2. Inbound HTTP/2 support does not establish outbound HTTP/2 parity across artifacts.

Requested capability

• Enable and verify outbound HTTP/2 in both musl and glibc packaging targets.
• Expose an explicit HTTP/2 requirement with a clear failure when negotiation cannot satisfy it.
• Support client certificates and private keys, including PEM and PKCS#12 credentials, per client configuration.
• Expose connection/request timeout and connection reuse behavior consistently in JVM and native implementations; preserve normal certificate and hostname verification.

Acceptance criteria

• Local fixtures verify HTTP/2 negotiation and rejection of an HTTP/1.1-only peer when HTTP/2 is required.
• Mutual TLS succeeds with a valid credential and rejects missing, wrong, expired, or untrusted credentials.
• Different client credentials cannot share an authenticated connection incorrectly.
• Packaged musl and glibc artifacts demonstrate the same API behavior with no secret material in logs.

Current implementation

• vm/backend/impl/parparvm/com/codename1/backend/Web.java
• vm/backend/impl/javase/com/codename1/backend/Web.java
• vm/backend/native/cn1_backend_web.c
• vm/backend/docker/Containerfile.musl

Validate behavior on the JVM and locally on the packaged ParparVM backend where applicable. This request does not call for native-image or GraalVM CI jobs.