feat(ext/node): add native TLSWrap cppgc object (Rust core) (#33183)

## Summary
- Port `TLSWrap` from #32819 as a standalone Rust-only addition (2952
lines)
- Adapted to work with existing `libuv_stream::TCP` (not the
`tcp_wrap::TCPWrap` replacement from #32819)
- `TLSWrap` is a cppgc object inheriting from `LibUvStreamWrap` that
intercepts TCP reads, feeds encrypted data through rustls, and emits
cleartext to JS
- No JS wiring yet — the object is registered but unused. JS integration
is the next PR
- Key adaptations from #32819:
  - `attach()` takes `libuv_stream::TCP` instead of `tcp_wrap::TCPWrap`
- `build_server_config` uses `with_single_cert` (not `SingleCertAndKey`)
  - Uses `deno_tls::rustls` re-export (no new Cargo deps)
  - Adds `client_session_store` to `NodeTlsState` for session resumption

---------

Co-authored-by: Nathan Whitaker <user@example.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>