Consolidate http client connection implementations

This ticket is a result of PUP-7482.

Puppet does not allow callers to specify which CA certs should be trusted when making SSL connections (see PUP-5069). As a result, there are three places where we create SSL connections, and configure the X509::Store:

1. puppet/network/http/factory

2. puppet/util/http_proxy

3. puppet/forge/repository

There are several inconsistencies as a result:

1. persistent connections are used for 1, but not 2
2. We send "Ruby" as the user-agent for 2
3. We don't send the X-PUPPET-VERSION header for 2
4. 1 and 2 handle proxy settings differently.