chore: bump agent-rs to 0.48 git rev for rustls provider feature

[lwshang]

Summary

• Pins ic-agent, ic-utils, ic-identity-hsm to HEAD of agent-rs main (01b6b2c, == 0.48.0), picking up dfinity/agent-rs#732 which adds tls-aws-lc-rs (default) and tls-ring cargo features for rustls crypto provider selection.
• Workspace ic-agent declared with default-features = false, features = ["pem"] so each crate opts into its own TLS feature.
• dfx and icx-asset enable tls-aws-lc-rs because both call Agent::builder() with the default reqwest client (where ic-agent now needs a provider installed, else panics with "No provider set").
• dfx-core does not add any TLS feature plumbing. Its build_agent supplies its own client via with_http_client, on which ic-agent installs no provider, so pem alone is enough.

Investigation notes

Should dfx-core forward TLS features?

No. Two reasons:

1. dfx-core never uses ic-agent's default-client path — with_http_client short-circuits the provider install.
2. dfx-core doesn't pub use ic_agent, so any downstream consumer who calls Agent::builder() already has their own ic-agent dep and picks their TLS feature there.

Should workspace reqwest switch to rustls-no-provider?

No. PR 732 made that switch in ic-agent because rustls 0.23 unification with both ring and aws_lc_rs features active panics when picking a default provider. Our workspace doesn't hit that — the only other reqwest is 0.12.28 (via pocket-ic) with no TLS features enabled. Switching would also require us to CryptoProvider::install_default(...) before each Client::builder().use_rustls_tls() call in dfx-core, util/mod.rs, and project/import.rs — added complexity for no concrete benefit.

A cleaner refactor (drop the manual use_rustls_tls() calls, let ic-agent build its own default client) could centralize TLS choice in ic-agent's features, but is left as a possible follow-up.

Test plan

• cargo check --workspace passes
• cargo check -p dfx-core passes (no other workspace crate pulls in tls-aws-lc-rs)
• cargo check -p dfx-core --no-default-features --features tls-ring — N/A here (no dfx-core features added); but verified during investigation
• Smoke test dfx against mainnet / local replica to confirm TLS still works at runtime

🤖 Generated with Claude Code