Hello up there. As agreed in !18 (closed) I'm adding neos:// URI scheme that forces TLS usage + related adjustments and fixes. The main change is in patch 2, whose description I quote below:

---- 8< ----
client: Allow to force TLS via neos:// scheme

Similarly to how it is done with e.g. http:// and https:// - if neos:// is given TLS usage is forced and ca/cert/key must be there either in the URI itself, or in $NEO_CA, $NEO_CERT and $NEO_KEY environment variables mimicking the way how e.g. for https:// TLS credentials are taken from host environment, not from the uri.

The latter might be usability convenience, but is also useful for WCFS which needs to be able to remove secrets from uri on zurl normalization.

Please see discussion at !18 (comment 184439) for details.
---- 8< ----

/cc @jm, @levin.zimmermann