fix(build): configure TLS backends to use rustls

- Add rustls feature to self_update crate to avoid native-tls
- Configure reqwest to use rustls-tls-native-roots
- Use local sigstore-verification path for testing
- Update Cross.toml to install clang for bindgen

This is a work in progress to eliminate OpenSSL dependency
for ARM builds.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

Author: jdx