Add an option to disable CA certificate pinning

[cisco-dmytro-hissa]

Description

• Added disable_ca_pinning: keyword argument to DuoApi#initialize that, when set to true, skips passing the bundled ca_certs.pem to Net::HTTP, allowing TLS verification to fall back to the OS trust store instead
  of pinning to Duo's CA bundle
• Added mutual exclusivity check: raises ArgumentError if both disable_ca_pinning: true and a custom ca_file: are provided, since the two options are contradictory
• Added ca_pinning_disabled attr_reader for inspecting the pinning state
• Refactored Net::HTTP.start to build HTTP options dynamically, only including ca_file when it is non-nil

How Has This Been Tested?

• test_default_has_ca_pinning_enabled — verifies default behavior is unchanged: pinning enabled, ca_file points to bundled cert
• test_disable_ca_pinning_removes_ca_file — verifies disable_ca_pinning: true sets ca_file to nil
• test_disable_ca_pinning_and_custom_ca_file_raises — verifies ArgumentError is raised when both options are set
• test_disable_ca_pinning_and_custom_ca_file_error_message — verifies the error message is descriptive
• test_custom_ca_file_without_disable_works — verifies custom ca_file still works when pinning is not disabled
• test_pinned_client_passes_ca_file_to_http — verifies at the HTTP layer that a pinned client passes ca_file to Net::HTTP.start
• test_unpinned_client_does_not_pass_ca_file_to_http — verifies at the HTTP layer that an unpinned client omits ca_file from Net::HTTP.start while still using VERIFY_PEER

Types of Changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)