feat: switch to aws-lc-rs cryptography provider (#178)

Switches crypto provider to keep
chatmail codebase consistent,
analogous to https://github.com/chatmail/core/pull/8313

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>

filtermail/src/tls.rs

@@ -16,7 +16,7 @@ pub async fn wrap_rustls<IO>(
 where
     IO: AsyncRead + AsyncWrite + Unpin,
 {
-    let config = configure_rustls(resumption_store, dangerous_no_cert_verification);
+    let config = configure_rustls(resumption_store, dangerous_no_cert_verification)?;
     let tls = tokio_rustls::TlsConnector::from(Arc::new(config));
     let name = rustls::pki_types::ServerName::try_from(hostname)?.to_owned();
     let tls_stream = tls.connect(name, stream).await?;
@@ -26,13 +26,16 @@ where
 pub fn configure_rustls(
     resumption_store: Arc<ClientSessionMemoryCache>,
     dangerous_no_cert_verification: bool,
-) -> rustls::ClientConfig {
+) -> Result<rustls::ClientConfig, crate::error::Error> {
     let root_cert_store =
         rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
 
-    let mut config = rustls::ClientConfig::builder()
-        .with_root_certificates(root_cert_store)
-        .with_no_client_auth();
+    let mut config = rustls::ClientConfig::builder_with_provider(Arc::new(
+        rustls::crypto::aws_lc_rs::default_provider(),
+    ))
+    .with_safe_default_protocol_versions()?
+    .with_root_certificates(root_cert_store)
+    .with_no_client_auth();
 
     // Enable TLS 1.3 session resumption
     // as defined in <https://www.rfc-editor.org/rfc/rfc8446#section-2.2>.
@@ -50,5 +53,5 @@ pub fn configure_rustls(
             .set_certificate_verifier(Arc::new(NoCertificateVerification::default()));
     }
 
-    config
+    Ok(config)
 }