fix(gax-httpjson): insert Conscrypt as provider #1 in Security and preserve default SSLContext

Author: lqiu96

sdk-platform-java/gax-java/gax-httpjson/src/main/java/com/google/api/gax/httpjson/HttpJsonConscryptUtils.java

@@ -32,6 +32,7 @@
 import com.google.api.client.http.javanet.NetHttpTransport;
 import com.google.api.core.InternalApi;
 import java.security.Provider;
+import java.security.Security;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import org.conscrypt.Conscrypt;
@@ -74,7 +75,9 @@ private static class ConscryptProviderHolder {
 
     private static Provider createProvider() {
       try {
-        return Conscrypt.newProvider();
+        Provider provider = Conscrypt.newProvider();
+        Security.insertProviderAt(provider, 1);
+        return provider;
       } catch (Throwable t) {
         LOG.log(
             Level.WARNING, "Conscrypt native libraries not available. Falling back to JDK TLS.", t);
@@ -97,27 +100,25 @@ public static NetHttpTransport.Builder configureConscryptSecurityProvider(
     if (conscryptProvider == null) {
       return builder;
     }
-    return builder
-        .setSecurityProvider(conscryptProvider)
-        .setSslSocketConfigurator(
-            socket -> {
-              if (!Conscrypt.isConscrypt(socket)) {
-                return;
-              }
-              try {
-                Conscrypt.setNamedGroups(socket, DEFAULT_PQC_GROUPS);
-              } catch (Exception e) {
-                // Native JNI linkage errors (e.g. UnsatisfiedLinkError) are caught during
-                // ConscryptProviderHolder initialization. Catching Exception here safely
-                // intercepts runtime socket configuration errors (e.g. unsupported groups or
-                // closed socket) without swallowing JVM errors like OutOfMemoryError.
-                LOG.log(
-                    Level.WARNING,
-                    "Failed to set PQC named groups on Conscrypt socket. Falling back to Conscrypt"
-                        + " default TLS groups.",
-                    e);
-              }
-            });
+    return builder.setSslSocketConfigurator(
+        socket -> {
+          if (!Conscrypt.isConscrypt(socket)) {
+            return;
+          }
+          try {
+            Conscrypt.setNamedGroups(socket, DEFAULT_PQC_GROUPS);
+          } catch (Exception e) {
+            // Native JNI linkage errors (e.g. UnsatisfiedLinkError) are caught during
+            // ConscryptProviderHolder initialization. Catching Exception here safely
+            // intercepts runtime socket configuration errors (e.g. unsupported groups or
+            // closed socket) without swallowing JVM errors like OutOfMemoryError.
+            LOG.log(
+                Level.WARNING,
+                "Failed to set PQC named groups on Conscrypt socket. Falling back to Conscrypt"
+                    + " default TLS groups.",
+                e);
+          }
+        });
   }
 
   /**