API clients: make thread-local, allowing use of persistent requests sessions

[risicle]

On the long long road to https://trello.com/c/ORGrd1jn/498-upgrade-docker-images-for-our-ecs-apps-to-debian-bookworm

This should allow us to confidently upgrade to openssl 3.x without significant performance degradation.

As ever, I suggest reading the individual commits separately as they have their own extensive comments (yes, one of the commits is huge though)

See also https://github.com/alphagov/notifications-api/pull/4179