[security] ensure https -> rejectUnauthorized uses the default (true)

When `rejectUnauthorized` isn't provided to `hyperquest`, it's set to `undefined` which is falsey so `https` treats that as such and does not reject bad (or self-signed) certs.

This PR ensures that when `rejectUnauthorized` isn't provided to `hyperquest`, https behaves according to its defaults.