feat(http): add opt-in Windows HTTP and HTTPS transport - #3994

What

Blocked by upstream policy; preserved for forks. Upstream explicitly decided that a host-backed libSceHttp is not wanted on main, and closed #3844 as not planned (decision). This PR remains open pending the author’s decision to withdraw it; it is not ready for upstream acceptance under the stated policy. The complete, rebased feature remains available on aadi-varc/AnyPS5:codex/http-winhttp-fork-only.

The fork adds an experimental Windows WinHTTP transport enabled with APS5_HTTP_NETWORK=1. The default remains offline, and libSceHttp2 remains offline. This is a Windows fork feature; it does not change upstream’s offline policy.

Exports dispatch to separate offline and network implementations. The offline implementation retains current main's epoll waits, context teardown and CA-list behavior. Four commits separate handle/state management, WinHTTP transport, export dispatch, and tests/documentation.

The backend supports binary blocking requests, response headers/status/length, chunked responses, optional GZIP decoding, redirects, timeouts, concurrent independent requests and cancellation. Automatic redirects with Authorization, Proxy-Authorization or Cookie headers throw before sending. Deleting a parent invalidates and cancels descendants.

HTTPS uses Windows trust and certificate checks. Certificate-loading/CA-list APIs, epoll, enabled nonblocking operations, nonnull request-status callbacks, proxy/authentication/cookie support, explicit TLS versions and chunked uploads throw when requested. USAGE.md warns that custom-certificate initialization can stop a title before its first request. Console semantics and remaining gaps are recorded in docs/dev/debt/libSceHttp.md.

No third-party code is added. The localhost integration test generates disposable credentials with OpenSSL. Missing Python or OpenSSL reports CTest skip code 77; certificate-generation errors, timeouts and guest failures remain failures. These changes address the four implementation/reviewability points in the draft feedback.

Tested

Windows 10.0.26300 x86-64, WinLibs GCC 15.2.0 r7, Release, Python 3.12.14. Current head: 2636a48, rebased onto main 3864da595.

• Resolved the new core/libs/CMakeLists.txt conflict by preserving upstream’s nid_shared_strings test and the HTTP offline test’s explicit environment. Documented the fork-only policy in USAGE.md.
• Rebuilt the four HTTP/offline targets and updated dependencies. guest_offline_imports, guest_http, guest_http_response_header and guest_http_network all passed with APS5_HTTP_NETWORK=1 in the parent shell (2.67 seconds total), including real HTTP/HTTPS loopback requests. Conventions, whitespace and test-registration checks passed.
• HTTP runtime sources remain identical to previously validated b889391, which passed the full Windows project build and five relevant tests, including patched_libraries (8.31 seconds total). The full project build was not repeated for the subsequent rebases and test-environment/documentation changes.
• The readiness audit covered handle ownership, hierarchical deletion, concurrent cancellation, WinHTTP callback lifetime, export ABI, offline compatibility and the test harness. No blocking runtime defect was found. Missing Python/OpenSSL produce explicit CTest skips; other test failures are propagated.
• No commercial title, PS5 hardware, Linux or macOS runtime validation. Native request-handle closure failure explicitly terminates; this exceptional OS path was not reproduced. Full upstream CI still requires a maintainer; passing checks would not override the stated policy.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in libSceHttp technical debt
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source (none added)
• Generic behaviour, not specific to one title
• Depends on: none
• Unblocks: none (no title bring-up validated)
• AI-assisted: yes (Codex)