GeezerVison

Combines the community PRs that change how the REST client builds its
urllib3 pool (#968, #1008, #1026, #1033, #1034).

- CA bundle: both clients verify TLS with ca_certs if given, then the
  SSL_CERT_FILE or REQUESTS_CA_BUNDLE environment variable, then
  certifi (#998).
- RESTClient(maxsize=10): connections kept per host. urllib3 defaults
  to 1, so threaded clients kept opening new TLS connections.
- RESTClient(connection_pool_kw=...): other urllib3 pool options,
  merged over the defaults (#1009).
- RESTClient(proxy=...): explicit proxy URL, with credentials from the
  URL. Proxy environment variables aren't read, so existing traffic
  doesn't change route. The WebSocket client already uses the system
  proxy via websockets.

Co-authored-by: SACHU JAMES <[email protected]>
Co-authored-by: Mohd Quamar Tyagi <[email protected]>
Co-authored-by: jakobovski-arb <[email protected]>
Co-authored-by: Roman Zydyk <[email protected]>
Co-authored-by: Kevin Chiu <[email protected]>

Adds connection options to the clients, combining #968, #1008, #1026,
#1033 and #1034 (contributors are credited as co-authors).

- **Custom CA:** `ca_certs=` on `RESTClient` and `WebSocketClient`,
defaulting to `SSL_CERT_FILE` / `REQUESTS_CA_BUNDLE`, then certifi.
Closes #998.
- **Pool size:** `RESTClient(maxsize=10)`. urllib3 defaults to 1
connection per host.
- **Pool options:** `RESTClient(connection_pool_kw={...})`, merged over
the defaults. Closes #1009.
- **Proxy:** `RESTClient(proxy="http://user:pass@host:port")`. Proxy env
vars aren't read, so nobody's traffic changes route.

The README has a new **Network Configuration** section with examples for
each case (custom CA, proxy, threads, other pool options).

All new parameters are optional and added at the end of the signatures.
The one behavior change: if `SSL_CERT_FILE` or `REQUESTS_CA_BUNDLE`
points to a file, it's now used instead of certifi (as `requests` and
Python do). If it points to a file that doesn't exist, it's skipped with
a warning, so a stale value doesn't break anyone.

Verified against the live API through a local TLS-inspecting proxy
(mitmproxy with auth): REST and WebSocket connect with the proxy's CA
(argument or env var) and fail certificate verification without it;
wrong proxy credentials get 407. Under 16 threads, `maxsize=10` opened
16 TLS connections vs 57–70 with urllib3's default.

---------

Co-authored-by: SACHU JAMES <[email protected]>
Co-authored-by: Mohd Quamar Tyagi <[email protected]>
Co-authored-by: jakobovski-arb <[email protected]>
Co-authored-by: Roman Zydyk <[email protected]>
Co-authored-by: Kevin Chiu <[email protected]>