feat(tls): expose trust_anchors and grease_sigalgs_enabled

[TimeTREE98]

Exposes trust_anchors and grease_sigalgs_enabled, which the Chrome 152+ presets set but TlsOptions does not forward. Without them a ClientHello built from scratch is missing the trust_anchors extension (0xca34) and the GREASE signature algorithm.

xref 0x676e67/wreq#1298

[saliencyy]

Tested this on a v0.13.0 backport: with grease_sigalgs_enabled and trust_anchors a ClientHello built from TlsOptions alone matches the Chrome 152+ emulation byte-for-byte (localhost capture, including the 0xca34 payload). It also reproduces real Chrome 155 / Chromium 155 / Edge / Brave on Linux (same JA4, peetprint and akamai fingerprint as the browsers on tls.peet.ws). One possible follow-up: ExtensionType has no TRUST_ANCHORS variant, so extension_permutation can't pin an order that includes 0xca34.

[TimeTREE98]

Thanks. Added it in the latest commit so extension_permutation can include 0xca34.