Make `serde` optional by introducing `query`, `form` features, and re-working WASM header parsing (#2858)

Breaking change since `query()` and `form()` are no longer available by default, but must be enabled.

For those using `dns_resolver()`, this shouldn't cause much change, though it
is technically breaking, since the types changed slightly. It should just
allow more types.

Removes `dns_resolver2()`.

This switches the default TLS provider to Rustls. It keeps the `native-tls` feature with the same configuration it had before as the default TLS provider.

* fix: Use prebuilt NASM compiled code on Windows.

See: https://github.com/aws/aws-lc-rs/blob/f0a6350abb247b413ffbf8ae8d8e1eb3bb1d4e66/aws-lc-sys/README.md?plain=1#L37

* fix: Update the precise version of aws-lc-rs for nightly builds.
* fix: Update all Windows targets to use prebuilt nasm binaries.

ref #2897
ref #2723

Co-authored-by: David Calavera <1050+calavera@users.noreply.github.com>

This includes two logical change groups, done together because the intermediate step is not really useful.

1. This makes rustls-platform-verifier the default verifier, and removes the ability to use rustls with webpki or native roots directly.
2. This soft-deprecates many of the TLS-related builder methods, providing better names that are clearer and autocomplete better.

This greatly simplifies the configuration matrix of what could be enabled, but also means the removal of some parts that some people may have been using. The consolidated API should still _allow_ users to do these things.

For example, instead of adding webpki-roots with a feature flag, you should use the webpki-roots crate yourself, and pass them into `tls_certs_only(certs)`.

Closes #2885

- `ClientBuilder::trust_dns()`
- `ClientBuilder::no_trust_dns()`
- `Request::fetch_mode_no_cors()` on non-WASM targets

…2901)