tinyhttps 0.3.5

[Sunrisepeak]

Registers one patch release. It is a patch of a version consumers already name, so ^ resolution reaches it without a manifest change.

package	version	sha256 (GLOBAL = CN)	source
tinyhttps	0.3.5	6f75f9e6a630ee44df75b1c3e5af21791f449966999cabd778586834183558a3	mcpplibs/tinyhttps#24, mcpplibs/tinyhttps#25

0.3.5: the TLS handshake is bounded by connectTimeoutMs, so a server or proxy that accepts the connection and never answers the ClientHello no longer holds a request for good; HttpClientConfig::extraCaFile adds a PEM file of roots to the default store, for a private CA or a proxy that re-signs TLS.

tests/examples/tinyhttps moves to 0.3.5 and checks the new API without a network: extraCaFile is empty unless set and can be set, and a pointer to TlsSocket::connect_over names the new trailing handshakeTimeoutMs parameter, which is the one source change the release asks of anyone.

Verified locally before opening:

• Both mirrors were downloaded after publication and compared; they match the sha256 above.
• The descriptor checks pass: lua syntax, mirror URLs, package name, reserved namespace, cross-package references, platform parity, duplicate versions, and mcpp xpkg parse.
• The member resolves 0.3.5 from this checkout and passes with the mirror set to CN and to GLOBAL, each with the package cache cleared.