Remove or gate danger_accept_invalid_certs in HTTP client

[coderabbitai]

Description

The HTTP client in src/upload.rs (line 17) currently uses danger_accept_invalid_certs(true), which disables TLS certificate validation. This exposes the application to potential man-in-the-middle (MITM) attacks.

Suggested Approach

• Remove the danger_accept_invalid_certs(true) call and enable proper certificate validation by default
• If self-signed certificates are needed for development/testing environments, gate this setting behind a configuration flag that defaults to false
• For controlled environments requiring custom certificates, consider loading and trusting a specific CA bundle instead of disabling validation globally

Context

This issue was identified during code review and flagged as a pre-existing security concern.

Related PR: #92
Comment: #92 (comment)
Reported by: @mike1858