fix: read PHASE_VERIFY_SSL env var so SSL bypass works

[sundaram2021]

Description 📣

What

The SSL error message tells users to set PHASE_VERIFY_SSL=False to bypass certificate
verification, but the environment variable was never read anywhere in the CLI — so the bypass
didn't work for any command, including the pre-auth external identity flows
(phase auth --mode aws-iam / --mode azure) against self-hosted instances with self-signed
certificates.

This PR reads PHASE_VERIFY_SSL once at startup and applies it to the SDK, making the
long-advertised bypass actually work.

Fixes #292

Why it was broken

• The only occurrence of PHASE_VERIFY_SSL in the codebase was the error string in
  pkg/errors/errors.go — nothing read the variable.
• The SDK's switch (misc.VerifySSL) defaults to true and was never set anywhere
  (not even by sdk.New()).
• The SDK memoizes its HTTP client on first use, so the flag must be set before the first
  request. That's why it's applied in the root command's init() rather than in
  PersistentPreRun — a subcommand-defined PersistentPreRun would silently override a
  root-level one.

Changes

• pkg/config/env.go (new): ConfigureSSLVerification() — disables verification only when
  PHASE_VERIFY_SSL equals false (case-insensitive), mirroring the Python CLI's semantics
  (os.environ.get("PHASE_VERIFY_SSL", "True").lower() != "false").
• cmd/root.go: call the helper in init(), before any command or network call — this
  covers the pre-auth aws-iam/azure flows, which don't go through NewPhase().
• pkg/config/env_test.go (new): table-driven tests for the parsing semantics.

Behavior

PHASE_VERIFY_SSL	TLS verification
unset / empty	on (unchanged)
false / False / FALSE	off
true, 0, no, anything else	on (fail-closed)

No behavior change unless the variable is explicitly set to false.

Testing

• go vet ./..., go test ./..., go build ./... pass (10 new unit cases covering the value
  matrix above).

• Verified end-to-end against a local HTTPS server with a self-signed certificate, through the
  real SDK client path:

  • default → 🗿 SSL error: ... x509: certificate signed by unknown authority ... (fail-closed)
  • PHASE_VERIFY_SSL=False → request succeeds (TLS bypassed)
  • PHASE_VERIFY_SSL=banana → SSL error (fail-closed)

• Quick reproduction for reviewers — point the CLI at a self-signed endpoint with a dummy token
  and watch the error type flip:

  export PHASE_SERVICE_TOKEN="pss_service:v1:$(printf '0%.0s' {1..64}):$(printf '0%.0s' {1..64}):$(printf '0%.0s' {1..64}):$(printf '0%.0s' {1..64})"
  PHASE_HOST=https://self-signed.badssl.com phase apps                          # 🗿 SSL error
  PHASE_HOST=https://self-signed.badssl.com PHASE_VERIFY_SSL=False phase apps   # HTTP error → TLS bypassed

Notes

• PHASE_VERIFY_SSL=False disables MITM protection and is intended for dev / break-glass use.
  For production self-hosted instances, trusting the CA is preferable — on Linux, Go already
  honors SSL_CERT_FILE=/path/to/ca.pem with no code changes. Happy to add a docs note
  (docs live in a separate repo).
• Deliberately scoped to PHASE_VERIFY_SSL env var is never read — SSL bypass doesn't work #292: phase update (plain http.Get to pkg.phase.dev) and
  PHASE_DEBUG wiring are untouched.

Type ✨

• Bug fix
• New feature
• Breaking change
• Documentation

[rohan-chaturvedi]

@sundaram2021 This lgtm! Lets just take care of the missing trailing newlines. We can just run gofmt:

gofmt -w src/cmd/root.go src/pkg/config/env.go src/pkg/config/env_test.go

and then get this merged.