Post-handshake authentication

[ocheron]

Adds basic client/server support for PHA.

Primary goal is to have client support for scenarios where this is needed by the server. The extension is sent unconditionnally since it is not any different than a renegotiation handshake before TLS13, which is always possible. Existing configuration and hooks about client authentication will apply, so this should minimize impact of enabling TLS13.

Ability for a server to request authentication is also added, with design similar to key update. i.e. the API does nothing before TLS13, and does not try to trigger a renegotiation instead.

Internally the existing client-certificate code is reused, with handshake state being reverted at specific locations. The reasons for reverts are:

• successive post-handshake authentications don't cumulate in the transcript
• in case of several authentication requests in parallel, the client decides which one to honour first and the server can't anticipate any transcript update
• the server may request authentication before receiving client Finished13, so CertRequest13 is appended to the correct transcript only when receiving the matching Certificate13

As consequence, state modifications are not preserved after completion of the authentication sequence, but this is similar to what handshakeTerminate does before TLS13.

[kazu-yamamoto]

I believe that return is safer than pure from the backward compatibility point of view.

[kazu-yamamoto]

Except pure, this PR looks good to me.

[kazu-yamamoto]

I changed pure to return and merged this PR.

[ocheron]

Thanks. More a style issue than compatibility.