Upstream the QUIC packet protection to rustls-rustcrypto (and get a release)

[lann]

Two pieces of this repository exist only because upstream gaps forced them (recorded in rust/tls/README.md and rust/quinn/README.md); both are candidates to contribute upstream and then retire here.

• rustls-rustcrypto QUIC support: upstream ships quic: None on every suite and a todo!() quic.rs. Our rust/quinn/src/packet.rs (RFC 9001 packet + header protection over RustCrypto, pinned to the Appendix A vectors) is most of the needed PR. Upstreaming moves the QUIC wiring into the provider's own suite definitions and deletes our suite-rebuilding shim (suites.rs).
• quinn-proto provider-agnostic rustls feature: rustls is a legacy alias for rustls-ring, so enabling quinn's rustls glue hard-wires ring into the tree. A rustls-no-provider-style feature (rustls dep without ring/aws-lc-rs) would let rust/quinn/src/session.rs (vendored, adapted) retire.
• rustls-rustcrypto release: no usable crates.io release since 0.0.2-alpha (2024); we carry a pinned git dependency. Nudge for a release; drop the git pin when one exists.
• While the vendored session glue exists, track upstream crypto/rustls.rs changes on quinn-proto upgrades (the adaptation is mechanical but not automatic).

[lann]

On the third bullet (the rustls-rustcrypto git dependency): the workspace manifest's git reference is currently unpinned (git = "https://github.com/RustCrypto/rustls-rustcrypto", no rev), so only Cargo.lock holds the 7b44a2d pin. Downstream path/git consumers of lann-tls-quinn (component-iroh is one as of polymorph-components/polymorph-iroh#5's adoption) re-resolve the manifest reference under their own lockfiles, so a rev = "7b44a2d..." in the workspace manifest would make the pin hold for consumers too, until the crates.io release this bullet asks for exists.

[lann]

Sizing the alternative to the first and third checkboxes: replacing this repository's use of rustls-rustcrypto (the provider glue only — rustls itself and the RustCrypto primitive crates stay) with in-repo code.

Anchor: the whole pinned crate is 1,700 lines; we reach a strict subset (three touch points: provider() filtered to the profile, sign::any_eddsa_type, and the two TLS13_* suite statics that rust/quinn/suites.rs rebuilds).

Keep-set, measured at the pinned rev with tls12-gated lines removed:

Piece	~LOC
Record AEAD glue (TLS 1.3 paths, ChaCha20-Poly1305 + AES-128-GCM only)	240
Verification breadth (verify/*, full RFC 8446 §9.1 set — profile policy)	222
Key exchange (X25519 + P-256; P-384 instantiation dropped)	100
Hash + HMAC (SHA-256; HKDF costs zero — rustls's own HkdfUsingHmac)	90
Signing (eddsa + slim dispatcher; ecdsa/rsa signers are policy-excluded)	90
Provider assembly, 2 suite statics, scheme list, SecureRandom	100
Misc helpers	25
Implementation	~870

Not needed: quic.rs (the todo!() stub — packet.rs already lives here), sign/{ecdsa,rsa}.rs, the AES-256 suite, all tls12 code, SHA-384-only paths.

Plus direct vectors for newly first-party glue (~150–300) and doc rework (~50–100); minus rust/quinn/suites.rs (52), which dissolves once the statics are in-repo and carry the quic slot directly. Net ≈ 1.1 kLOC.

Trade-offs, stated once:

• Solves the release-blocker checkbox unilaterally (no git pin, crates.io publication unblocked) and inverts the first checkbox's direction — internalize the seam instead of upstreaming packet.rs and waiting on release cadence. The quinn-proto checkbox is untouched either way (session.rs stays vendored until their feature lands).
• The dependency graph barely changes: primitive crates all stay; only the adapter crate and its pin go. Audit burden arguably shrinks — the provider audit already reads this glue line-by-line at the pinned rev; first-party glue (nonce/AAD assembly, key routing) is an easier review class than a third-party crate at a moving rev.
• The verification set is the swing factor: ~25% of the LOC and pure policy. Narrowing it would also drop the rsa crate from the tree — a profile decision, out of scope here.
• The honest cost is not the ~1.1 kLOC; it is forking maintenance of code the ecosystem should fix once. Against upstream's actual cadence (nothing usable released since 2024), it is genuinely arguable rather than clearly wrong.

[lann]

The migration to noq-proto (#25) resolves this issue's second half by adoption rather than upstreaming: noq-proto's rustls feature is provider-agnostic — initial_suite_from_provider takes the initial suite from the config's own provider, and the retry tag uses RustCrypto aes-gcm — so the re-hosted session.rs is deleted and the glue is consumed from upstream. The quinn-lineage PR this half contemplated is moot for us.

Remaining scope: upstreaming the packet module (rust/quic/src/packet.rs, the rustls::quic::Algorithm implementations, now including the multipath _for_path methods) to rustls-rustcrypto, whose QUIC slot is still a todo!() stub.

[lann]

Rescoping after the noq-proto port (#25) and the quinn→quic rename (#24). The second checkbox is resolved by adoption: noq-proto's rustls feature is provider-agnostic, the vendored session.rs is deleted, and quinn-proto is out of the tree entirely — the quinn-lineage PR is moot for us, and the fourth checkbox (tracking upstream rustls glue while the vendored copy existed) is moot with it. Remaining scope is the first and third checkboxes: upstreaming rust/quic/src/packet.rs (now including the multipath _for_path methods) to rustls-rustcrypto, whose quic.rs is still todo!()-stubbed at HEAD with no functional movement since April 2024, and nudging for a crates.io release — the manifest-side pin concern from the first comment was addressed in 7dd0a7b. Given upstream's cadence, the internalize-the-glue alternative sized in the earlier comment remains a live option against the first checkbox. Retitling to drop "quinn-rustls" accordingly.