Address review comments: keep original gates, add static config gates

[pragyagandhi]

Summary

Follow-up to #38 addressing the review comments, plus the changes required to make the
"no GnuTLS / non-TLS only" build actually compile and pass CI.

The GnuTLS / RPC-with-TLS dependency is removed so builds are not blocked on distros
where gnutls is not an allowed package (e.g. Azure Linux). The only supported transport is
non-TLS (xprtsec=none), and AZAUTH (AzAuthNone) is always sent as the first RPC over
that non-TLS connection.

The two flags

After this change there is exactly one valid build configuration: HAVE_TLS off,
ENABLE_INSECURE_AUTH_FOR_DEVTEST on.

Flag	After the change	Guards
HAVE_TLS	Never defined (gnutls detection removed)	All RPC-with-TLS code
ENABLE_INSECURE_AUTH_FOR_DEVTEST	Defaults ON; required	The "send AZAUTH over a non-TLS connection" path

Changes

• CMakeLists.txt
  • Drop find_package(GnuTLS) / -DHAVE_TLS / add_subdirectory(tls) — gnutls is never
    found, linked, or compiled.
  • ENABLE_INSECURE_AUTH_FOR_DEVTEST defaults ON; explicitly disabling it trips a
    FATAL_ERROR (static gate).
• include/libnfs-private.h
  • Static compile-time gates: #error if HAVE_TLS is enabled or if
    ENABLE_INSECURE_AUTH_FOR_DEVTEST is disabled.
  • use_azauth / auth_context moved out of the HAVE_TLS guard (AZAUTH is a non-TLS
    feature).
• lib/libnfs.c
  • xprtsec=none handled outside HAVE_TLS as a no-op (tls/mtls stay guarded).
  • Restored the original #ifndef ENABLE_INSECURE_AUTH_FOR_DEVTEST guard in
    nfs_set_auth_context and the #ifdef ENABLE_INSECURE_AUTH_FOR_DEVTEST gate (+comment)
    in rpc_connect_program_4_cb (per review).
  • Guarded rpc_connect_program_5_0_cb with #ifdef HAVE_TLS (TLS-only callback that
    otherwise fails to compile with TLS off).
  • Clear diagnostic when the server rejects / does not respond to the AZAUTH RPC.
• lib/socket.c
  • Restored the #ifdef ENABLE_INSECURE_AUTH_FOR_DEVTEST gate (+comment) on reconnect, and
    moved reconnect_cb_azauth out of the HAVE_TLS guard.

Why it is logically correct

The reverted #ifndef ENABLE_INSECURE_AUTH_FOR_DEVTEST block in nfs_set_auth_context
references wanted_xprtsec, a HAVE_TLS-only field. With TLS removed it would fail to
compile if INSECURE were off — it is safe only because the gates guarantee INSECURE
is always on, so that block is always compiled out. Walking the single enforced config
(HAVE_TLS=off, INSECURE=on):

Code segment	Result
#ifdef HAVE_TLS blocks (TLS handshake, 5_0_cb, tls/mtls parse)	compiled out
#ifndef INSECURE block (references wanted_xprtsec)	compiled out → no dangling ref
#ifdef INSECURE AZAUTH path	compiled in → AzAuthNone sent
xprtsec=none parse	accepted as a no-op

Any other flag combination fails loudly at build time (static gates) instead of misbehaving
at runtime.

Runtime flow

sequenceDiagram
    participant C as client
    participant L as libnfs
    participant S as Blob NFS server (:2048)
    C->>L: nfs_set_auth_context(authtype=AzAuthNone) -> use_azauth=TRUE
    C->>L: nfs_mount()
    L->>S: TCP connect (non-TLS)
    L->>S: AZAUTH RPC (AzAuthNone)  (always first, over non-TLS)
    alt server has AzAuth enabled
        S-->>L: AZAUTH OK
        L->>S: MOUNT / NFS ops
        S-->>C: mounted (or MNT3ERR_NOENT if container missing)
    else server without AzAuth
        S-->>L: no response / reject
        L-->>C: "AzAuth not enabled/setup on server" diagnostic
    end

Loading

Testing

• No gnutls linkage (ldd shows no gnutls/p11-kit/nettle/etc).
• Default build (cmake -B build -G Ninja) and -D ENABLE_TESTS=yes both build cleanly.
• AzAuth-enabled account: AzAuthNone accepted, proceeds to MOUNT.
• Non-AzAuth account: AZAUTH fails fast with the clear diagnostic.

Note: the exotic-platform CI checks (Cygwin/Windows/macOS/PS2/musl-QEMU) are pre-existing
failures on master; this PR introduces no new failures and fixes Linux-Musl-QEMU (i386).