Function client_tls_connector 

pub fn client_tls_connector(
    verify: bool,
    identity: Option<&Arc<UpstreamTls>>,
) -> Result<TlsConnector, String>

Builds a client TLS connector for a raw upstream WebSocket (wss) handshake.

ALPN is pinned to http/1.1 (the WebSocket upgrade is HTTP/1.1). When identity is set, the connector presents that client certificate (and trusts its private CA, if any) — mirroring OutboundClient::identity_client — and is cached per identity (UpstreamTls::cache_key), never evicted. When identity is None and verify is false, certificate verification is disabled (matching ssl_verify: false). The verified connector is cached, since loading the platform’s native root store on every connection is wasteful; the insecure connector is cheap and built on demand.