perf(video): 优化视频流水线并统一使用 vendored OpenSSL

使用固定采集、解码和编码线程及同步最新帧槽，减少同步异步跨界和无效 MJPEG 解码。

编码前预留消费者容量，以完整批次投递编码结果并隔离慢客户端，避免丢失 H.264 参考帧；保留 PTS 修正，不增加 IDR 节流。

复用 Annex-B 缓冲并增加低频发送分项统计，默认启用 vendored OpenSSL SRTP AES-CM 后端。

HTTP 客户端、HTTPS 服务端和本地 DTLS 证书验证迁移至 OpenSSL，移除 rustls TLS 引擎依赖，保留证书验证、媒体加密和原有协议协商。

vendor/dtls/README.md

@@ -0,0 +1,20 @@
+# DTLS certificate verification backend
+
+This directory contains `dtls` 0.17.2 from the crates.io release of webrtc-rs.
+The original MIT and Apache-2.0 licenses are preserved.
+
+One-KVM patches only certificate-chain verification and its configuration to
+use vendored OpenSSL instead of rustls/WebPKI. DTLS flights, record protection,
+certificate signatures, SRTP negotiation and the application fingerprint check
+remain unchanged. `rustls-pki-types` remains a certificate-data representation,
+not a TLS implementation.
+
+`certificate_verifier.rs` implements trust-anchor, purpose, certificate-validity
+and DNS/IP identity checks. Server names do not fall back to the certificate
+subject, and partial-label wildcards are rejected. No trust checks are skipped
+by this backend. The upstream application-controlled `insecure_skip_verify`
+policy is preserved, including WebRTC's separate certificate fingerprint check.
+Authentication security level 2 rejects weak RSA keys and SHA-1 leaf signatures.
+
+Run `cargo test --manifest-path vendor/dtls/Cargo.toml --lib` after updating this
+fork, and verify the application dependency tree contains no `rustls` engine.