Add NATS TLS configuration options to wash host and runtime-operator

[casualjim]

I have a nats cluster but it uses tls-first and a custom CA, with these changes the host and operator can communicate with it.

This was done by copilot, so I understand if you don't like these changes.

• Understand the codebase and identify affected areas
• Add --nats-tls-ca and --nats-tls-first flags to runtime-operator (Go)
• Add --nats-tls-ca, --nats-tls-first, and --nats-creds flags to wash host command (Rust)
• Update the connect_nats function in washlet to support TLS options
• Build and test the changes
• Run code review and address feedback
• Fix CryptoProvider panic by using ring consistently across all TLS dependencies