BUG/MEDIUM: ssl: isolate TLS session resumption per authentication policy

BUG/MEDIUM: ssl: isolate TLS session resumption per authentication policy

The session id context OpenSSL uses to allow or reject
session resumption) was so far scoped only to the frontend's own
certificate. Two SSL_CTXs presenting the same certificate but different
client-certificate policies (verify mode, ca-file, crl-file,
ca/crt-ignore-err) still shared that sid_ctx, so a session or ticket
obtained on a weakly-verified listener could be resumed on another
listener enforcing stricter mutual TLS, without ever re-presenting a
certificate.

Fix this by also hashing the verify mode, every CA certificate and CRL
loaded in the SSL_CTX's X509_STORE (ssl_ctx_hash_store()), and the
ca/crt-ignore-err bitfields into sid_ctx. CA certificates are hashed
the same way as leaf certificate (issuer/subject/serial); CRLs are
hashed by issuer and CRL Number extension.

Must be backported to every stable branch.

Reported-by: Yiyi Wang <wangyiyi25@mails.tsinghua.edu.cn>
Reported-by: Chris Jarrett-Davies <chrisjd@openai.com>