crypto/tls: use Config.GetCertificate before Config.Certificates, even without SNI

[gopherbot]

I'd like to be able to use GetCertificate to dynamically generate a certificate at the
time the request comes in (with caching on top). As is, the code always checks
config.Certificates first, even if it won't be used.

My wish is:

1. GetCertificate would be called even without SNI (no SNI shows up as
ClientHelloInfo.ServerName=="", the docs already talk about this)

2. config.Certificates would be looked at only if GetCertificate returns nil, nil

[rsc]

I doubt this can be changed without breaking Go 1.x compatibility.

@agl

[rsc]

Or maybe if Certificates == nil?

[agl]

https://go-review.googlesource.com/8792

[gopherbot]

CL https://golang.org/cl/8792 mentions this issue.