fix(mstsgu): use native SSPI for gateway auth

[Marc-André Moreau (mamoreau-devolutions)]

Use native Windows SSPI with TLS endpoint binding for regular RD Gateway HTTP Negotiate and NTLM authentication.

Fall back to portable authentication when native TLS binding is unavailable.

[Marc-André Moreau (mamoreau-devolutions)]

Validated against the authorized gateway with strict TLS: the native SSPI WebSocket-upgrade flow completed with 101 Switching Protocols.

A subsequent MS-TSGU handshake requested unsupported SmartCard extended authentication; no SmartCard credentials are configured, so full session establishment remains blocked. This is outside the HTTP-authentication scope.

Note

LLM-assisted content (no human feedback).

[Copilot]

Pull request overview

Adds Windows-native SSPI authentication with TLS endpoint binding for RD Gateway, retaining portable authentication as fallback.

Changes:

• Adds TLS channel-binding extraction and native SSPI authentication.
• Preserves WebSocket keys across authentication retries.
• Updates tests, documentation, dependencies, and changelog.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
crates/ironrdp-tls/tests/native_tls.rs	Tests channel-binding encoding.
crates/ironrdp-tls/src/native_tls.rs	Builds SSPI endpoint bindings.
crates/ironrdp-tls/src/lib.rs	Exports the binding helper.
crates/ironrdp-mstsgu/tests/packet_io.rs	Tests authenticated WebSocket retries.
crates/ironrdp-mstsgu/src/packet_io.rs	Propagates bindings into authentication.
crates/ironrdp-mstsgu/src/http_auth/native_http_auth.rs	Implements native Windows SSPI.
crates/ironrdp-mstsgu/src/http_auth/mod.rs	Selects native or portable authentication.
crates/ironrdp-mstsgu/README.md	Documents native authentication.
crates/ironrdp-mstsgu/CHANGELOG.md	Records the feature.
crates/ironrdp-mstsgu/Cargo.toml	Adds Windows bindings.
Cargo.lock	Records the dependency edge.