refactor: feature-switch for object_store CA certs

Closes apache#4870.

object_store/Cargo.toml

@@ -59,11 +59,13 @@ tokio = { version = "1.25.0", features = ["sync", "macros", "rt", "time", "io-ut
 nix = { version = "0.27.1", features = ["fs"] }
 
 [features]
-cloud = ["serde", "serde_json", "quick-xml", "hyper", "reqwest", "reqwest/json", "reqwest/stream", "chrono/serde", "base64", "rand", "ring"]
+cloud = ["dep:serde", "dep:serde_json", "dep:quick-xml", "dep:hyper", "dep:reqwest", "dep:reqwest/json", "dep:reqwest/stream", "dep:chrono/serde", "dep:base64", "dep:rand", "dep:ring"]
 azure = ["cloud"]
-gcp = ["cloud", "rustls-pemfile"]
+gcp = ["cloud", "dep:rustls-pemfile"]
 aws = ["cloud"]
 http = ["cloud"]
+tls-native-roots = ["dep:reqwest?/rustls-tls-native-roots"]
+tls-webpki-roots = ["dep:reqwest?/rustls-tls-webpki-roots"]
 
 [dev-dependencies] # In alphabetical order
 tempfile = "3.1.0"

object_store/src/lib.rs

@@ -86,6 +86,13 @@
     doc = "* [`http`]: [HTTP/WebDAV Storage](https://datatracker.ietf.org/doc/html/rfc2518). See [`HttpBuilder`](http::HttpBuilder)"
 )]
 //!
+//! Stores that use HTTPS/TLS (this is true for most cloud stores) can use the source of their [CA]
+//! certificates. This is controlled by a feature switch:
+//!
+//! - `tls-native-roots`: use certificates bundled with the operating system, see [`rustls-native-certs`]
+//! - `tls-webpki-roots`: use Mozilla's root certificates bundled with the library/application, see
+//!   [`webpki-roots`]
+//!
 //! # Why not a Filesystem Interface?
 //!
 //! Whilst this crate does provide a [`BufReader`], the [`ObjectStore`] interface mirrors the APIs
@@ -434,7 +441,10 @@
 //!
 //! [Optimistic Concurrency Control]: https://en.wikipedia.org/wiki/Optimistic_concurrency_control
 //! [Apache Iceberg]: https://iceberg.apache.org/
+//! [CA]: https://en.wikipedia.org/wiki/Certificate_authority
 //! [Delta Lake]: https://delta.io/
+//! [`rustls-native-certs`]: https://crates.io/crates/rustls-native-certs/
+//! [`webpki-roots`]: https://crates.io/crates/webpki-roots
 //!
 
 #[cfg(all(