fix(iroh-relay): strip trailing root-label dot from relay TLS server name

[Tyagiquamar]

Description

Fixes #4448 (relay client path).

iroh's default relay hostnames are absolute FQDNs with a trailing root-label dot (use1-1.relay.n0.iroh.link.). The relay client built its TLS ServerName verbatim from the URL host, so the trailing dot reached the certificate verifier.
ustls-platform-verifier passes the name to the OS verifier verbatim (CryptoAPI on Windows returns CERT_E_INVALID_NAME), making every default relay fail TLS with CaTlsConfig::system() on Windows. webpki tolerates the dot, which is why the default config never noticed.

This strips a single trailing dot where the relay URL becomes a ServerName in MaybeTlsStreamBuilder::tls_servername. DNS resolution still uses the full URL host and is unaffected, and the change is behavior-preserving for verifiers that already accept the dot.

Breaking Changes

None.

Notes & open questions

The reqwest-based HTTPS probes and the QAD probes derive their TLS server names from the same URLs through different code paths; they likely want the same normalization as a follow-up (QAD host handling is currently being reworked in #4527, so I left those lines untouched to avoid conflicts).

Change checklist

• Self-review.
• Documentation updates following the style guide, if relevant.
• Tests if relevant.
• All API changes documented.
• This PR was created by a human that thought critically about the proposed change and wrote an as clear and concise description as they could.
• This PR isn't slop, and is carefully crafted to do have the intended effect.

[Tyagiquamar]

Hi, just following up on this when you get a chance. The branch is up to date and checks are green. If it looks good from your side, it should be ready to merge. Happy to make any changes if needed. Thanks!

[flub]

This is not an unreasonable solution, but the inconsistency between the different code paths you point out in the notes & open questions are not great. Since rustls-platform-verifier is now released at 0.7.1 I'm in favour of closing this without any further changes I think.

[Tyagiquamar]

Thanks for the context. Agreed: since rustls-platform-verifier 0.7.1 now handles this (the trailing root-label dot in the relay TLS server name), this PR is superseded and there is no need to keep it open. I'll leave it with you to close if you prefer; happy to close it myself if that's easier.