[curl] Add apple-sectrust feature

[awesomekling]

Fixes #48355

Expose curl's USE_APPLE_SECTRUST option as a macOS-only feature.

This lets ports opt into Apple's native certificate verification for compatible curl TLS backends without changing curl's default behavior.

This can avoid certificate verification failures on macOS for sites that are trusted by the system trust store but not by a plain OpenSSL setup.

• Changes comply with the maintainer guide.
• SHA512s are updated for each updated download.
• The "supports" clause reflects platforms that may be fixed by this new version, or no changes were necessary.
• Any fixed CI baseline and CI feature baseline entries are removed from that file, or no entries needed to be changed.
• All patch files in the port are applied and succeed.
• The version database is fixed by rerunning ./vcpkg x-add-version --all and committing the result.
• Exactly one version is added in each modified versions file.

[awesomekling]

@microsoft-github-policy-service agree

[BillyONeal]

I think you need a

curl[core,apple-sectrust,mbedtls]=options
curl[core,apple-sectrust,wolfssl]=options

in ci.feature.baseline.txt. But I also don't see why this really should be a feature in the first place....

[BillyONeal]

Should this even be a feature or should we always just do it? (It's hard to imagine a case where one does not want this behavior)

[BillyONeal]

This looks like a newlines change but it isn't, the file is still correctly LF, this is just inserting extra spaces to get the options to line up again now that apple-sectrust is longer.

No change requested.

[BillyONeal]

It looks like this doesn't currently blow up because we already have:

curl[core,http3,gnutls]=options
curl[core,http3,mbedtls]=options
curl[core,http3,wolfssl]=options

so the combined feature test picks http3 and excludes gnutls, mbedtls and wolfssl. But I still think we should add lines for this (if it remains as a feature)

[dg0yt]

Does this feature depend on openssl libs?

And do we want an apple-specific feature? A similar capability exists for Windows (CURL_CA_NATIVE).