all: explicit TLS MinVersion in tls.Config

Go's default is already TLS 1.2+ (since Go 1.18), but making this
explicit satisfies RFC 7858/9250 recommendations and makes the security
intent clear for auditors.

internal/certs/root_ca_test.go

@@ -11,7 +11,8 @@ func TestCACertPool(t *testing.T) {
 	c := &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: &tls.Config{
-				RootCAs: CACertPool(),
+				RootCAs:    CACertPool(),
+				MinVersion: tls.VersionTLS12,
 			},
 		},
 		Timeout: 2 * time.Second,

internal/controld/config.go

@@ -351,7 +351,7 @@ func apiTransport(loggerCtx context.Context, cdDev bool) *http.Transport {
 		return dial(ctx, "tcp6", addrsFromPort(apiIpsV6, port))
 	}
 	if runtime.GOOS == "android" {
-		transport.TLSClientConfig = &tls.Config{RootCAs: certs.CACertPool()}
+		transport.TLSClientConfig = &tls.Config{RootCAs: certs.CACertPool(), MinVersion: tls.VersionTLS12}
 	}
 	return transport
 }