Support urllib3 1.26.x and 2.x

[pquentin]

This changes the assert_fingerprint hack to more directly tell urllib3 that we'll assert the fingerprint ourselves to add support for pinning root certificates, not only the leaves.

See #105 for more context.

[ezimuel]

LGTM!

[pquentin]

To make sure this could be released, I tested this quite extensively.

I initially tried with Elasticsearch in Docker Compose, but I noticed that Elasticsearch would only present the server certificate, and not the full chain including the generated root CA. It is allowed to do so (https://stackoverflow.com/questions/34945244/should-the-trusted-root-ca-be-a-part-of-the-certificate-chain) but my understanding is that this prevents asserting a fingerprint of the root CA in elastic-transport-python because we look at the certificates we get, not by which certificate they are signed.

Then I used Elastic Cloud with two different servers (one in Belgium and the other in Paris) and checked that it presented the whole chain (server, R3 and ISRG Root X1). I was then able to test that I could assert fingerprint for R3 and ISRG Root X1 for bother servers and for urllib3 1.26.x and 2.0.x using the following code:

import base64

from elastic_transport import NodeConfig, Transport

transport = Transport(
    [
        NodeConfig(
            "https",
            "$NAME.es.europe-west9.gcp.elastic-cloud.com",
            443,
            ssl_assert_fingerprint="$FINGERPRINT",
        )
    ]
)
print(
    transport.perform_request(
        "GET",
        "/",
        headers={
            "Content-Type": "application/json",
            "Authorization": "Basic "
            + base64.b64encode(b"elastic:password").decode(),
        },
    ).body
)

This can now be relased. 🎉