ECH: cleanups

[bagder]

• passing an unknown string to CURLOPT_ECH now returns error

  To properly allow applications to spot if they pass in a typo or
  something to libcurl.

• CURLECH_DISABLE is now a plain zero internally, not a dedicated bit which
  simplifies checks for when ECH is enabled

• Dropped the CURLECH_CLA_CFG bit, and just check STRING_ECH_CONFIG

• Turn grease/enable/hard into three different numerical values, no bitmask
  needed

• Convert the struct field 'tls_ech' from an int to a byte.

[Copilot]

Pull request overview

This PR tightens CURLOPT_ECH option parsing in curl_easy_setopt() so applications can reliably detect typos/unknown strings by receiving an error return, rather than silently accepting an unrecognized value.

Changes:

• Refactors CURLOPT_ECH parsing into a dedicated helper (setopt_ech()) and returns CURLE_BAD_FUNCTION_ARGUMENT for unknown strings.
• Updates the lib1521 option-error allowlist generator to treat CURLOPT_ECH as an option that may return CURLE_BAD_FUNCTION_ARGUMENT for invalid strings.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
tests/libtest/mk-lib1521.pl	Adds CURLOPT_ECH to the set of string options allowed to return CURLE_BAD_FUNCTION_ARGUMENT for unrecognized values.
lib/setopt.c	Introduces setopt_ech() and makes CURLOPT_ECH return an error for unknown strings.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

[bagder]

augment review

[augmentcode]

🤖 Augment PR Summary

Summary: This PR refactors libcurl’s ECH (Encrypted Client Hello) option handling to be stricter on invalid input and simpler internally.

Changes:

• Centralizes CURLOPT_ECH parsing in a new setopt_ech() helper and returns an error for unknown strings
• Simplifies internal ECH state by replacing bitmasks with enum-like numeric values (with CURLECH_DISABLE as 0)
• Removes CURLECH_CLA_CFG and instead uses stored string presence (e.g. STRING_ECH_CONFIG) to infer CLI config
• Converts tls_ech storage from int to uint8_t and updates OpenSSL/rustls/wolfSSL backends accordingly
• Updates the lib1521 generator allowlist so CURLOPT_ECH may return CURLE_BAD_FUNCTION_ARGUMENT for invalid strings

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.