http: verify TLS certs by default + cap the response body — set_verify(NONE) unconditionally let a MITM read/forge the account-registration & captcha traffic (usernames, emails, plaintext passwords) POSTed to operator-configured https URLs; now the connector's cert+hostname check stays on (opt out with http_tls_verify=no), and read_to_end is bounded to 4 MiB so a hostile endpoint can't OOM the worker

src/server.rs

@@ -471,6 +471,7 @@ impl Server {
         headers: Vec<(String, String)>,
     ) {
         let tx = self.event_tx.clone();
+        let verify = self.conf_bool("http_tls_verify", true);
         std::thread::spawn(move || {
             let (status, body) = crate::http::post(
                 &url,
@@ -478,6 +479,7 @@ impl Server {
                 &body,
                 &headers,
                 std::time::Duration::from_secs(10),
+                verify,
             )
             .unwrap_or((0, String::new()));
             let _ = tx.send(crate::ircd::Event::HttpResult {