feat: add --allow-insecure-certs flag for local development

[JustinBeckwith]

Summary

Adds a new --allow-insecure-certs flag that allows linkinator to ignore SSL/TLS certificate validation errors. This is useful for local development environments with self-signed or untrusted certificates.

Fixes #618

Changes

• ✅ Added allowInsecureCerts option to CheckOptions interface
• ✅ Added --allow-insecure-certs CLI flag with help documentation
• ✅ Updated makeRequest() to use undici Agent with rejectUnauthorized: false when flag is enabled
• ✅ Moved undici from devDependencies to dependencies (needed at runtime)
• ✅ Added comprehensive test coverage for certificate validation scenarios
• ✅ All 145 tests pass (including 4 new tests)

Usage

CLI

linkinator https://localhost:3000 --allow-insecure-certs

Programmatic API

import { check } from 'linkinator';

const result = await check({
  path: 'https://localhost:3000',
  allowInsecureCerts: true
});

Test Plan

• Unit tests pass (145/145 tests passing)
• New certificate validation tests added and passing
• Manual CLI testing with self-signed certificates
• Linter passes with no errors
• Feature works as expected with https://self-signed.badssl.com/

Security Considerations

The flag is secure by default (requires explicit opt-in) and follows the existing pattern of other security-related flags like --require-https. Users must explicitly enable it, preventing accidental bypass of certificate validation.

🤖 Generated with Claude Code