Allow providing a PSR-18 HTTP client (or just timeout controls?)

[Firehed]

Besides making the library's own unit testing easier, this allows users to provide preconfigured clients. This is MOSTLY to support customizing timeouts, but could improve handling other network tweaks (such as proxies, buffering, DNS, etc)

This should NOT be a required parameter, and ideally is done in a way that adds no additional runtime dependencies. In practice, this also means that providing an HTTP Client also requires providing a RequestFactory and StreamFactory, to avoid ending up in a weird transitional situation

Areas of caution:

• Allowing HTTP clients we don't directly control opens up the possibility of being given one that has insecure settings (such as SSL verification being disabled). The PSR interface doesn't provide a mechanism to detect and reject this.
• Similarly, a misconfigured client could break authentication or transport options. This is mostly "on your own head be it", but does invite problems that are otherwise avoided