Certificate checks on identity backends that still follow proxy.certificate_check #1556

Follow-up from PR #1487.

Description

Provider lookups already force certificate_check: true (ec/coordinator/transport.rs:196). Pull sync still uses settings.proxy.certificate_check (ec/pull_sync.rs:237), so a setting relaxed for a test origin also relaxes TLS verification for partners that receive the EC ID. When PR B turns pull sync into a provider, it should keep the forced check.

Reproduction steps

1. Configure an enabled identity provider (fictional example: example-provider, https://id.example.com).
2. Exercise the path described above with a test EC (for example ec-0000-test).
3. Observe the behaviour described.

Expected behavior

Always verify certificates on every identity backend (providers and pull sync), and add a test that a relaxed proxy.certificate_check never reaches them.

Acceptance criteria

• Pull sync and every provider backend always verify certificates, regardless of proxy.certificate_check.
• A test shows a relaxed proxy.certificate_check never reaches identity backends.
• PR B's pull-sync provider keeps the forced check.

Affected area

Core (Edge Cookies, GDPR)

Code: crates/trusted-server-core/src/ec/pull_sync.rs; ec/coordinator/transport.rs.

Version

main with PR #1487 (feat/s2s-eid-after-response).

Review threads

• Collect server-side identity provider EIDs in a single page-load write #1487 (comment)