fix(ext/tls): avoid panic for mismatched client certificate and key

[maoyouaa]

Summary

• Propagate the rustls validation error when a client certificate and private key do not match instead of panicking through .expect().
• Apply the error propagation to both client configuration paths in create_client_config().
• Add a regression test verifying that Deno.createHttpClient() throws a TypeError for mismatched credentials.

The validation error is now surfaced through the existing TlsError conversion path:

TypeError: keys may not be consistent: KeyMismatch

This prevents invalid user-provided TLS credentials from terminating the Deno process.

Testing

• Reproduced the original panic with the official Deno 2.9.4 Windows binary.
• Verified that the patched runtime returns TypeError: keys may not be consistent: KeyMismatch without printing the Deno panic banner.
• Targeted runtime regression test: 1 passed, 139 filtered out.
• cargo check -p deno_tls --features deno_core/quickjs
• cargo test -p deno_tls --features deno_core/quickjs — 3 passed; 1 doctest ignored.
• cargo clippy -p deno_tls --features deno_core/quickjs -- -D warnings
• cargo fmt --all -- --check
• Targeted dprint check for tests/unit/fetch_test.ts
• Deno lint for tests/unit/fetch_test.ts
• git diff --check

A full default V8-based Windows build could not be completed because Windows Developer Mode is disabled, preventing rusty_v8 from creating its required symbolic links.

AI assistance: OpenAI Codex was used only to review the patch and test results.

Fixes #36380

[deno-cla-assistant]

Deno Individual Contributor License Agreement

All contributors have signed the CLA. Thank you!

• @maoyouaa

Re-run CLA check

---

This is an automated message from CLA Assistant

[bartlomieju]

Thanks