fix(server): install rustls default CryptoProvider at startup

[moonming]

Summary

aisix panics on first TLS handshake (etcd connect, reqwest /dp/register, etc.) with:

```
thread 'main' panicked at rustls/.../crypto/mod.rs:249:14:
Could not automatically determine the process-level CryptoProvider from Rustls crate features.
```

rustls 0.23 dropped implicit provider selection — when both `aws-lc-rs` and `ring` are reachable through transitive deps (reqwest `rustls-tls`, etcd-client, tokio-rustls…), the runtime can't pick. Fix: call `aws_lc_rs::default_provider().install_default()` at the very top of `main`, before anything else.

`let _ =` because install is idempotent and the return value only signals "another crate got there first" — which doesn't affect correctness.

Why aws-lc-rs and not ring

It's the upstream rustls default as of 0.23, FIPS-capable out of the box, and already in the transitive dep graph through reqwest + etcd-client. Picking it avoids adding another RSA/EC crypto implementation to the binary.

How we caught it

AISIX-Cloud e2e stack exposed this: the DP container is `docker run` via the test harness, hits this panic within 100ms of startup, exits, and `docker run --rm` removes the container before the harness can query `docker port`. Container logs now dumped on failure.

Test plan

• `cargo build --bin aisix`
• `cargo fmt --check`
• `cargo clippy --all-targets --locked -- -D warnings`
• CI green
• Re-publish `ghcr.io/moonming/ai-gateway:aisix-e2e` from main so AISIX-Cloud e2e picks it up

[Copilot]

Pull request overview

Ensures aisix doesn’t panic on first TLS usage under rustls 0.23 by explicitly installing a process-wide rustls CryptoProvider at startup.

Changes:

• Install the aws-lc-rs rustls CryptoProvider at the start of main() to avoid runtime provider auto-detection panics when multiple crypto backends are present via transitive dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The comment says this "falls back to ring" if a provider is already installed, but the code doesn't install ring or perform any fallback logic; it simply keeps whatever default provider was installed first. Consider rewording to avoid implying ring is involved (e.g., "if another provider is already installed, keep it").

Suggested change

	// already depends on transitively. Falls back to ring only if
	// the process somehow has a provider installed already (idempotent).
	// already depends on transitively. If another provider is already
	// installed for the process, `install_default()` keeps it unchanged.