Add TLS support (upgrade-after-INFO)

[ChrisFrizza6969]

Add TLS support (upgrade-after-INFO)

Summary

Adds client TLS so the driver can connect to TLS-required servers such as
Synadia NGS (tls://connect.ngs.global). Currently
the client only speaks plaintext — it always sends CONNECT with
tls_required: false and never performs a TLS handshake — so any server that
advertises tls_required: true resets the connection.

Motivation

NGS (and any NATS server with tls: {...}) sends a plaintext INFO advertising
tls_required: true, then expects the client to run the TLS handshake before
CONNECT. Without TLS there is no way to use this driver against those servers.

What changed

• Config: new optional ?Amp\Socket\ClientTlsContext $tls (default null
  = existing plaintext behavior, fully backward compatible). fromURI enables
  TLS from a tls:// / nats+tls:// / ssl:// scheme, defaulting the peer name
  to the host for SNI/verification; fromArray accepts a tls key.
• SocketConnectionFactory: attaches the TLS context to the ConnectContext
  so the socket can be upgraded (it does not connect TLS-first).
• Framer: when TLS is configured, the single reader fiber reads the
  plaintext INFO line, runs setupTls(), and then pushes INFO to the
  parser. Doing the upgrade inside the sole socket-reader fiber preserves the
  single-reader invariant (amphp forbids concurrent reads on a socket); pushing
  INFO only after the handshake completes prevents startup() (a different
  fiber) from writing CONNECT mid-handshake and corrupting the stream.
• SocketConnection::startup() is unchanged (no TLS logic).

Compatibility

The non-TLS code path is byte-for-byte unchanged: when $tls is null,
$upgradeTls is false and the Framer behaves exactly as before. Existing
tests are unaffected.

Scope / limitation

Implements the standard NATS upgrade-after-INFO flow. Servers configured with
tls { handshake_first: true } (TLS handshake before INFO) are not covered by
this PR.

Tests

• Added ConfigTest cases: tls:// / nats+tls:// / ssl:// produce a
  ClientTlsContext with the host as peer name; a non-TLS scheme leaves tls
  null; fromArray accepts a tls key.
• Verified locally: php-cs-fixer (no diff), phpunit ConfigTest green,
  phpstan level max / strict clean on the changed files.
• Manually verified end-to-end against real NGS: plaintext INFO →
  setupTls() → CONNECT → PONG, plus JetStream object store list/get/put
  over the resulting TLS connection.