fix: warn when TLS verification is disabled

REDMINE_VERIFY=false / verify_ssl: false silently disabled TLS
certificate verification, exposing the connection to MITM attacks.
Config.validate() now prints a warning to stderr when verification
is disabled (exactly False; True or a CA-bundle path stays quiet).
validate() runs exactly once at CLI startup, so the warning is
emitted once per run and is visible in every scenario.

Closes #57

redmine_reporter/config.py

@@ -1,5 +1,6 @@
 import logging
 import os
+import sys
 from dataclasses import dataclass, field
 from datetime import date, timedelta
 from pathlib import Path
@@ -406,6 +407,13 @@ class Config:
                 "REDMINE_URL must use HTTPS: the API key is sent in request "
                 "headers and requires TLS"
             )
+        if cls.get_redmine_verify() is False:
+            print(
+                "⚠️  TLS certificate verification is disabled "
+                "(REDMINE_VERIFY=false / verify_ssl: false): connection is "
+                "vulnerable to MITM attacks",
+                file=sys.stderr,
+            )
         if cls.get_redmine_api_key():
             return
         if not (cls.get_redmine_user() and cls.get_redmine_password()):