Fall back to unverified SSL when system CA store is unavailable

The old ponylang/http HTTPClient silently created an unverified SSL
context when the caller's context was None. Our SSLContextFactory
was treating set_authority(None)? failure as fatal, which broke on
systems without a discoverable CA bundle (e.g. WSL2 without
ca-certificates). Passing None to set_authority means "use the
default system CA store" — when there isn't one, there's nothing to
verify against, so falling back to set_client_verify(false) is the
correct behavior.

This also simplifies callers: SSLContextFactory now always returns
SSLContext val (never None), eliminating the match/None branch in
all four request actors and LinkedJsonRequester. Removed unused
ssl and lori imports from request actors.

Author: SeanTAllen

github_rest_api/paginated_list.pony

@@ -2,7 +2,6 @@ use courier = "courier"
 use "json"
 use lori = "lori"
 use "promises"
-use ssl = "ssl/net"
 use req = "request"
 
 interface tag LinkedResultReceiver
@@ -163,13 +162,9 @@ actor LinkedJsonRequester is courier.HTTPClientConnectionActor
     | let parsed: courier.ParsedURL =>
       _request_path = parsed.request_path()
       let config = courier.ClientConnectionConfig
-      match req.SSLContextFactory()
-      | let ctx: ssl.SSLContext val =>
-        _http = courier.HTTPClientConnection.ssl(
-          _creds.auth, ctx, parsed.host, parsed.port, this, config)
-      | None =>
-        _fail("Unable to create SSL context")
-      end
+      _http = courier.HTTPClientConnection.ssl(
+        _creds.auth, req.SSLContextFactory(), parsed.host, parsed.port,
+        this, config)
     | let _: courier.URLParseError =>
       _fail("Unable to parse URL: " + url)
     end

github_rest_api/request/_ssl.pony

@@ -2,16 +2,19 @@ use ssl = "ssl/net"
 
 primitive SSLContextFactory
   """
-  Creates an SSL context configured for HTTPS client connections with
-  certificate verification enabled.
+  Creates an SSL context for HTTPS client connections. Attempts to load the
+  system CA store for certificate verification. If no CA store is available,
+  falls back to an unverified context.
   """
-  fun apply(): (ssl.SSLContext val | None) =>
+  fun apply(): ssl.SSLContext val =>
     try
       recover val
         ssl.SSLContext
           .>set_client_verify(true)
           .>set_authority(None)?
       end
     else
-      None
+      recover val
+        ssl.SSLContext.>set_client_verify(false)
+      end
     end

github_rest_api/request/check_requester.pony

@@ -1,7 +1,5 @@
 use courier = "courier"
-use lori = "lori"
 use "promises"
-use ssl = "ssl/net"
 
 interface tag CheckResultReceiver
   """
@@ -60,13 +58,9 @@ actor CheckRequester is courier.HTTPClientConnectionActor
     | let parsed: courier.ParsedURL =>
       _request_path = parsed.request_path()
       let config = courier.ClientConnectionConfig
-      match SSLContextFactory()
-      | let ctx: ssl.SSLContext val =>
-        _http = courier.HTTPClientConnection.ssl(
-          _creds.auth, ctx, parsed.host, parsed.port, this, config)
-      | None =>
-        _fail("Unable to create SSL context")
-      end
+      _http = courier.HTTPClientConnection.ssl(
+        _creds.auth, SSLContextFactory(), parsed.host, parsed.port,
+        this, config)
     | let _: courier.URLParseError =>
       _fail("Unable to parse URL: " + url)
     end

github_rest_api/request/json_requester.pony

@@ -1,7 +1,5 @@
 use courier = "courier"
 use "json"
-use lori = "lori"
-use ssl = "ssl/net"
 
 interface tag JsonRequesterResultReceiver
   """
@@ -79,13 +77,9 @@ actor JsonRequester is courier.HTTPClientConnectionActor
     | let parsed: courier.ParsedURL =>
       _request_path = parsed.request_path()
       let config = courier.ClientConnectionConfig
-      match SSLContextFactory()
-      | let ctx: ssl.SSLContext val =>
-        _http = courier.HTTPClientConnection.ssl(
-          _creds.auth, ctx, parsed.host, parsed.port, this, config)
-      | None =>
-        _fail("Unable to create SSL context")
-      end
+      _http = courier.HTTPClientConnection.ssl(
+        _creds.auth, SSLContextFactory(), parsed.host, parsed.port,
+        this, config)
     | let _: courier.URLParseError =>
       _fail("Unable to parse URL: " + url)
     end

github_rest_api/request/no_content_requester.pony

@@ -1,7 +1,5 @@
 use courier = "courier"
-use lori = "lori"
 use "promises"
-use ssl = "ssl/net"
 
 interface tag DeleteResultReceiver
   """
@@ -79,13 +77,9 @@ actor NoContentRequester is courier.HTTPClientConnectionActor
     | let parsed: courier.ParsedURL =>
       _request_path = parsed.request_path()
       let config = courier.ClientConnectionConfig
-      match SSLContextFactory()
-      | let ctx: ssl.SSLContext val =>
-        _http = courier.HTTPClientConnection.ssl(
-          _creds.auth, ctx, parsed.host, parsed.port, this, config)
-      | None =>
-        _fail("Unable to create SSL context")
-      end
+      _http = courier.HTTPClientConnection.ssl(
+        _creds.auth, SSLContextFactory(), parsed.host, parsed.port,
+        this, config)
     | let _: courier.URLParseError =>
       _fail("Unable to parse URL: " + url)
     end