pub(crate) fn tls_provider() -> Provider
rustls on the aws-lc-rs provider, trusting the system’s root certificates.