Support SPP 9.0 TLS 1.3: pin HTTP/1.1 and add optional TLS 1.3 enforcement

[DanPeterson]

Summary

SPP 9.0 enables TLS 1.3. safeguard-ps already authenticates successfully against 9.0 on both Windows PowerShell 5.1 and PowerShell 7, but a few changes make its TLS/HTTP behavior explicit and give customers control.

Changes

1. Pin HTTP/1.1

On the Standard binding, cert-based auth requires HTTP/1.1 — HTTP/2 disallows the post-handshake certificate request. Pin HTTP/1.1 so cert-auth works regardless of ingress: add HttpVersion = '1.1' to the Invoke-RestMethod/Invoke-WebRequest splat in Invoke-WithoutBody/Invoke-WithBody (PowerShell 7). Windows PowerShell 5.1 is already HTTP/1.1-only.

2. Optional TLS 1.3 enforcement

SecurityProtocol handling in Edit-SslVersionSupport is additive, so 1.3 can't be required. Add an opt-in (e.g. -RequireTls13 on Connect-Safeguard, persisted in $SafeguardSession):

• PowerShell 7: pass -SslProtocol Tls13.
• Windows PowerShell 5.1: set SecurityProtocol to Tls13 only.

Default behavior is unchanged.

3. Documentation

Document 9.0 TLS behavior and the new enforcement option.

Acceptance criteria

1. Default connect + cert-auth succeeds against a 9.0 appliance on PowerShell 7 and Windows PowerShell 5.1 with no extra flags.
2. REST calls negotiate HTTP/1.1.
3. With TLS 1.3 enforcement enabled, sub-1.3 connections fail closed; cert-auth still succeeds at 1.3.
4. Existing default deployments are unchanged.
5. No PSScriptAnalyzer -Strict regressions; src/ stays PS 5.1-compatible and ASCII-only.

Testing

Validate against a live 9.0 appliance on both editions; regression Connect, CertificateAuthentication, and A2ACredentials suites.