Implement crash-safe streaming worker runtime

crates/remora-hf-source/src/source.rs

@@ -40,6 +40,26 @@ impl<R: Resolver> HfSource<R> {
         }
     }
 
+    pub fn new_with_root_certificates(
+        resolver: R,
+        policy: OutboundPolicy,
+        timing: RetryTiming,
+        roots: impl IntoIterator<Item = Vec<u8>>,
+    ) -> Result<Self, HfSourceError> {
+        let timing = timing.sanitized();
+        let mut client =
+            OutboundClient::builder(resolver, policy).connect_timeout(timing.connect_timeout);
+        for root in roots {
+            let root =
+                reqwest::Certificate::from_der(&root).map_err(|_| HfSourceError::InvalidRequest)?;
+            client = client.add_root_certificate(root);
+        }
+        Ok(Self {
+            client: client.build(),
+            timing,
+        })
+    }
+
     pub async fn resolve(
         &self,
         request: HfSourceRequest,