Harden panic-prone parsing and QUIC connection error paths

[Copilot]

This change addresses security-relevant crash vectors caused by unwrap() in externally influenced paths (env/plugin options, cert loading, and connection retry/connect flows). The goal is to convert panic-based failure modes into controlled errors or safe degradation.

• Input/env parsing hardening

  • parse_env_addr() no longer unwraps resolved socket addresses; it now returns explicit errors when resolution yields no address.
  • parse_plugin_options() now tolerates malformed segments (e.g. missing = / empty key) without panicking, while preserving valid entries and empty values where appropriate.
  • Added test coverage for malformed plugin option input behavior.

• Client-side TLS/QUIC resilience

  • Replaced panic-prone native cert handling with non-panicking processing:
    • native cert loader errors are logged,
    • invalid certs are skipped instead of aborting.
  • Replaced connect(...).await ... .unwrap() with propagated error handling.
  • Removed panic risk in rebind logging when local socket address lookup fails.

• Server-side retry path hardening

  • Replaced conn.retry().unwrap() with explicit error handling and logging to prevent process abort on retry failure.

// before
let ss_local_addr = format!("{}:{}", ss_local_host, ss_local_port)
    .to_socket_addrs()?
    .next()
    .unwrap();

// after
let ss_local_addr = format!("{}:{}", ss_local_host, ss_local_port)
    .to_socket_addrs()?
    .next()
    .ok_or_else(|| anyhow!("resolved no local socket address"))?;