TLS I/O layer: event-driven core, backends as thin codecs (supersedes #101)

[MrIron-no]

Summary

Replaces #101. That PR fixed the inbound-handshake busy-loop and the kqueue
EOF ordering, but its review (10 findings) and the follow-up data-path review
kept pointing at the same root cause: engine, sendq, IPcheck and flood logic
was duplicated across the TLS backends and the socket-interest decisions were
scattered ad hoc through the event loop. Rather than keep patching that shape,
this PR restructures the TLS layer and carries the #101 fixes inside the new
design.

Design

Core — new ircd/tls_io.c / include/tls_io.h:

• Socket interest is computed from connection state in exactly one place
  (level-triggered model), never pushed ad hoc. TLS breaks the plaintext
  assumption that "readable = want to read, writable = want to send" — a TLS
  write can block waiting to read and vice versa (renegotiation, TLS 1.3
  KeyUpdate, a partial record). tls_desired_events() /
  tls_want_writable() own that mapping, so interest can never drift out of
  sync with what the TLS session needs, and a level-triggered writable socket
  cannot spin.
• The send drain (tls_io_sendv) owns the con_rexmit / msgq_excise
  partial-write bookkeeping; the receive path records the blocked direction.
• Fatal-error teardown marks the socket dead so a failed TLS connection can
  never fall back to plaintext.
• Peer-fingerprint storage and the handshake trust policy
  (cert-required / verifypeer / fingerprint pin) live here too.

Backends (tls_openssl, tls_gnutls, tls_libtls, tls_none) become thin
codecs: read / write / handshake / drop primitives plus setup. They never
touch msgq, con_rexmit, cli_tls_fingerprint, FLAG_*, or
socket_events — kept honest by a grep invariant.

Handshake: driven by ET_READ / ET_WRITE, bounded by a single
handshake-deadline timer for both directions, waiting on exactly the blocked
direction. sendq enforcement, IPcheck (before make_client() on accept),
flood and throttle all apply to TLS through the existing read_packet() /
send_queued() paths — there is no parallel I/O path.

Fixes carried in

• s_bsd: never touch cptr after read_packet() may have freed it
  (CPTR_KILLED).
• s_bsd: report an outbound handshake failure that arrives as EOF/error —
  previously a silent teardown with no operator notice.
• s_bsd: free the TLS session, Client and IPcheck count on rejected accepts
  (unbounded growth under a reconnect flood to a TLS port).
• send_queued: a zero-credit TLS success (a rexmit drain that excised the
  last queued message) is progress, not a block — don't strand an empty
  connection on send_queues.
• tls_openssl: harden every context (NO_RENEGOTIATION | NO_COMPRESSION).
• tls_gnutls: refuse client-initiated renegotiation (parity with OpenSSL);
  bound the handshake loop.
• engine_kqueue: deliver unread data before EOF (from Drive the inbound TLS handshake by socket events; kqueue: deliver unread data before EOF #101; validated on
  FreeBSD).

Relation to the #101 findings

Findings 1–3 and 5–10 are addressed, most of them structurally rather than by
point fixes: the single interest model removes the WANT_WRITE misreporting and
the READABLE-during-WANT_WRITE spin (3, 5); the single deadline timer replaces
the three per-backend checks and the timer-dispatch copy (7, 10); the gnutls
retry loop no longer encodes "retry" as a fake socket direction (6); IPcheck
runs before allocation on accept (8); and the outbound path no longer
duplicates the negotiate dispatch (9). Findings 1 and 2 are the s_bsd /
kqueue fixes above.

Finding 4's remainder — every engine's SO_ERROR pre-check drops a peer's
final line on RST, engine-independent — is deliberately not in this PR.
It is now reproduced deterministically on Linux/epoll and filed with a fix
sketch as #104 (the FIN case needs no epoll fix, confirmed by the same repro).

Testing

• Misbehaving-peer harness (tests/tls/test_tls_bogus_peer.py): drives
  OpenSSL through ssl.MemoryBIO so each scenario controls which bytes hit
  the wire and when — silent peers, stalled/dribbled ClientHello, garbage,
  RST/FIN mid-handshake, a peer that never reads (write-blocked server
  flight), post-handshake flood, plus outbound scenarios against a controlled
  server sidecar. Every scenario checks the deadline, no CPU spin, and that a
  healthy client keeps getting PONGs.
• Real TLS 1.3 KeyUpdate mid-session (test_tls_keyupdate.py), REHASH cert
  rotation under a live connection (test_tls_rehash.py), s2s TLS burst with
  the hub in both TLS roles (test_tls_s2s_burst.py), and data-path teardown
  regressions (test_tls_datapath_repro.py).
• Full tests/tls/ suite green on all three backends (TLS_BACKEND =
  openssl / gnutls / libtls; selection documented in tests/README.md).
• C unit suite for the core (ircd/test/tls_io_t.c, runs under make check
  with no docker or TLS library): a scripted fake backend drives tls_io.c
  through a 36-case socket-interest truth table, the send drain (rexmit
  parking/resumption, the rexmit-bytes-never-credited rule, zero-credit
  success, priority and three-way wire ordering, fatal teardown), receive
  direction recording, fingerprint edge cases, and the negotiate trust-policy
  matrix. Backend error classification is deliberately left to the
  TLS_BACKEND matrix above.
• Tested on FreeBSD (kqueue), including the unread-data-before-EOF ordering.