feat: extend certificate pinning to all TLS protocols and add SSH

host-key pinning

internal/protocol/webdav/protocol.go

@@ -246,8 +246,21 @@ func (p *Protocol) getHTTPTransport() *http.Transport {
 		return p.httpTransport
 	}
 
+	// Build the TLS config from the caller-provided transport.TLSConfig
+	// (which carries CA certs, mTLS, pinned-cert hash, keylog, etc.)
+	// rather than a fresh tls.Config that would silently drop pinning.
+	var tlsClientCfg *tls.Config
+	if p.tlsConfig != nil {
+		if cfg, err := p.tlsConfig.ToTLSConfig(); err == nil {
+			tlsClientCfg = cfg
+		}
+	}
+	if tlsClientCfg == nil {
+		tlsClientCfg = &tls.Config{InsecureSkipVerify: p.insecureSkip} //nolint:gosec
+	}
+
 	tr := &http.Transport{
-		TLSClientConfig:     &tls.Config{InsecureSkipVerify: p.insecureSkip}, //nolint:gosec
+		TLSClientConfig:     tlsClientCfg,
 		DisableCompression:  true,
 		Proxy:               http.ProxyFromEnvironment,
 		MaxIdleConns:        100,