https: honor per-request TLS options over agent options

[axedos]

Per-request TLS options passed to https.request() / https.get() are silently
ignored when the https.Agent in use was constructed with the same option.
http.Agent merges the request options over the agent's own options, letting
the agent's value win.

That is surprising and can weaken security for TLS options in particular: a
per-request rejectUnauthorized: true on an agent configured with
rejectUnauthorized: false still sends the request with certificate
verification disabled. The same applies to ca and servername.

CVE-2026-58040 already handled this for checkServerIdentity by tagging the
request so the socket is not reused. This change generalizes that approach:

when a per-request rejectUnauthorized, ca, or servername differs from the
agent's value, request() captures the override and createConnection()
re-applies it, and the socket is not reused.

Refs: 52a8ace880d

[nodejs-github-bot]

Review requested:

• @nodejs/crypto
• @nodejs/http
• @nodejs/net

[github-actions]

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

• the guide for first-time contributors
• the contribution and automation policies
• the pull request guide
• the AI use policy
• the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.35%. Comparing base (bc6e1ad) to head (7145186).
⚠️ Report is 10 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66288      +/-   ##
==========================================
- Coverage   90.37%   90.35%   -0.02%     
==========================================
  Files         790      790              
  Lines      273807   273850      +43     
  Branches    52367    52389      +22     
==========================================
- Hits       247446   247441       -5     
- Misses      16869    16918      +49     
+ Partials     9492     9491       -1     

Files with missing lines	Coverage Δ
lib/https.js	98.11% <100.00%> (+0.90%)	⬆️

... and 36 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[MikeMcC399]

This PR is failing linting tests. See the comments in the tests for more detail.

See also Pull requests > Step 6: Test with further details in the linked document section BUILDING > Running tests.

To run the linter, use make lint / vcbuild lint. It will lint JavaScript, C++, and Markdown files.