Feature-gate schannel and windows-sys deps for windows-static-ssl only

[ns-ylambert]

Summary

schannel and windows-sys are unconditional [target.'cfg(target_env = "msvc")'.dependencies] in the curl wrapper crate. Both crates are consumed only by src/easy/windows.rs, which enumerates the Windows ROOT cert store and injects the DER-encoded certs into an OpenSSL SSL_CTX at TLS context creation time.

This bridge is only meaningful when curl is compiled against OpenSSL on Windows (i.e. windows-static-ssl):

• Under ssl on Windows, libcurl uses Schannel as the TLS backend, which reads the Windows trust store natively. No SSL_CTX bridge is needed and the code path is never called.
• Under rustls, there is no OpenSSL SSL_CTX at all.
• Under bare (no TLS feature) builds, same.

Yet both crates are currently compiled into every MSVC build regardless of the active TLS backend, inflating the dep graph and the final binary.

Change

Introduce a windows-cert-store intermediate feature that opts in both crates via dep: (making them optional), and have windows-static-ssl enable it. Tighten the #[cfg] guards on windows.rs to require the feature, so the entire schannel-crate-based code path compiles out under ssl, rustls, and bare builds.

windows-cert-store = [
    "dep:schannel",
    "dep:windows-sys",
]
windows-static-ssl = [
    "static-curl",
    "curl-sys/windows-static-ssl",
    "windows-cert-store",           # <-- new
]

Verification

cargo check --target x86_64-pc-windows-msvc --features windows-static-ssl continues to compile the windows.rs bridge.

cargo check --target x86_64-pc-windows-msvc (default ssl, Schannel path) and cargo check --target x86_64-pc-windows-msvc --features rustls,static-curl compile. schannel is removed from the dep graph; the wrapper crate's windows-sys features (Cryptography/LibraryLoader) are removed; curl-sys retains its own windows-sys dep for Winsock types and that is out of scope.

CI coverage for windows-static-ssl builds is kept out of this PR to keep the diff minimal. It is available in the companion fix-windows-static-ssl branch (#666).

Related

• Fix and cover the windows-static-ssl feature (curl+OpenSSL on Windows) #666. It makes windows-static-ssl builds functional (vcpkg include-path fix, OPENSSL_DIR probe, mutual-exclusion guard). This PR is standalone at the code level but windows-cert-store is only exercised once windows-static-ssl builds actually work.