expose a correct HTTPS client manager through a public interface

To use the servant client APIs you need a correctly configured manager. tahoe-great-black-swamp already includes code for a not-quite-correctly configured manager in client-test/Main.hs. This code should:

• be moved behind a public API in the library
• be extended with the necessary TLS certificate validation logic

Then gbs-downloader can use this API instead of implementing its own half-correct version.