…1191)

* Buffer read_json into memory when Content-Length is below the limit

serde_json's from_reader parses the response one byte at a time, which is
noticeably slower than parsing an in-memory slice. When the Content-Length
signals the body comfortably fits within the read limit, buffer it into a Vec
and parse with from_slice instead. A 1/3-of-limit cutoff keeps the buffered
bytes plus the deserialized value within the configured memory budget, and
chunked or oversized responses fall back to the existing streaming path.

Closes #1151

Co-authored-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com>
Co-authored-by: Martin Algesten <martin@algesten.se>

* Complete TLS handshakes while connecting

Both TLS backends defer the handshake until the request is written, after
the connection phase has already been recorded as complete. This puts the
handshake under the request timeout instead of the connection timeout.
Fixing phase-local deadline accounting would otherwise leave a
connect-only configuration without a TLS handshake timeout.

Complete each handshake in its connector using the connection timeout.
Preserve native-tls transport errors and cover timeout propagation through
both backends, including a successful handshake through a CONNECT tunnel.

* Anchor timeout budgets to phase boundaries

Each completed phase's deadline stayed in the set of timeouts checked by
the phases after it, so for instance timeout_recv_response kept applying
while the response body was read. The active phase also restarted its
budget on every lookup, so repeated reads or writes renewed the
timeout_send_body and timeout_recv_body budgets indefinitely.

Anchor each phase's budget to the completion of its latest predecessor
and check only that deadline together with the global and per-call
deadlines. Fail in Connection when a budget has already expired, since
transports cannot set a zero socket timeout and would otherwise grant a
short grace period per call.

Cover phase expiry, optional phase transitions and global/per-call
accounting across redirects with clock-based tests, and add a regression
test for an expired body budget that runs both through the test
transport and over real TCP.

Connection::reuse probes the socket for bytes the server sent after
the end of the body and drops the connection if it finds any. Harden
that check by also checking the bytes already buffered. This is
defense in-depth since connection pooling is bound by URL origin key,
thus no cross contamination risk.