Refactor TLS SSL context configuration

[Copilot]

Closes #3461.

TLS connections configured both SSL_CTX and SSL directly, even though SSL inherits connection options from its context. This refactors setup so each connection’s SSL_CTX is fully configured before creating the per-connection SSL.

• Context-first TLS setup

  • Delay SSL creation until after certificate, verification, and ALPN configuration is applied to SSL_CTX.
  • Keep connection-specific setup, such as SNI, on SSL.

• Clear certificate configuration phases

  • Split certificate application into explicit context and connection phases:

    cert->configure_context(cfg);
    create_ssl();
    cert->configure_connection(get_ssl());

• Safer OpenSSL handling

  • Add checks for touched OpenSSL calls and allocations.
  • Use RAII during BIO setup until ownership is transferred to OpenSSL.

• Focused coverage

  • Add a TLS unit test confirming verification mode is inherited by the created SSL connection.

[achamayou]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts in commit 766754b2b. Targeted validation passed with cmake --build build --target tls_test and ./build/tls_test.

[Copilot]

Pull request overview

This PR refactors the TLS setup flow so SSL_CTX is fully configured before constructing the per-connection SSL, aligning configuration with OpenSSL inheritance semantics and clarifying which settings are context-wide vs connection-specific.

Changes:

• Split certificate configuration into Cert::configure_context(SSL_CTX*) and Cert::configure_connection(SSL*), and update callers accordingly.
• Delay SSL creation in ccf::tls::Context until after SSL_CTX configuration is complete; add RAII protection for BIO allocation until ownership transfer.
• Add a TLS unit test ensuring a connection’s SSL inherits verification mode from its configured SSL_CTX.

Custom instructions used:

• .github/copilot-instructions.md
• .github/instructions/reviewing.instructions.md

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/tls/context.h	Defers SSL creation until after SSL_CTX setup; improves OpenSSL allocation safety around BIO ownership transfer.
src/tls/cert.h	Splits cert configuration into context vs connection phases (e.g., verification/certs vs SNI).
src/tls/client.h	Updates TLS test client to configure context first, then create/configure the connection.
src/tls/server.h	Updates TLS test server to configure context (including ALPN) before creating the connection SSL.
src/clients/tls_client.h	Refactors client TLS context creation to apply SSL_CTX config before BIO/SSL creation; keeps connection-only config on SSL.
src/tls/test/main.cpp	Updates existing cert verification test and adds inheritance-focused test coverage.

[achamayou]

@copilot fix the code format/syntax

[Copilot]

@copilot fix the code format/syntax

Fixed in the latest commit. The previous code review suggestions accidentally dropped the opening braces { from configure_context and configure_connection — those are now restored.