Joseph Doherty
5e01ad9c22
Mirror MxGatewayClient's three-branch handler structure in GalaxyRepositoryClient (CA-pin / lenient accept-all / OS trust) so the Galaxy endpoint works against the gateway's self-signed cert under the default lenient posture. Expose an internal CreateHttpHandlerForTests seam for unit testing. Add RemoteCertificateNameMismatch rejection at the top of both CA-pinned callbacks so a pinned-CA connection truly verifies the host. Strengthen existing lenient test to invoke the callback and assert it returns true; add mirrored Galaxy-client handler tests.