crypto/tls: don't negotiate RSA-PSS algorithms that are too big for our key

[FiloSottile]

A (weird, non-Go) client that prefers PSSWithSHA512 (minimum key size 1040 bits) but supports PSSWithSHA256 (minimum key size 528 bits) would fail to connect to a Go server with a certificate with a 1024 bit key.

We should refuse to negotiate parameters that we already know are not supported by the certificate key.

See #29779 (comment)

[FiloSottile]

This makes sense to tackle along with #32426 and #28660, as well as with updating the certificate selection logic.

[gopherbot]

Change https://golang.org/cl/205177 mentions this issue: crypto/tls: take key size into account in signature algorithm selection