Merge 1.34 with new BoringSSL

[dcillera]

PR to permit the review of 1.34 merge and updated BoringSSL version into envoy-openssl.

[tedjpoole]

The ssl_ctx_client_hello_cb() callback, used in the implementation for SSL_CTX_set_select_certificate_cb(), needs to be modified to handle an additional ssl_select_cert_disable_ech enumerator that has been added in the new BoringSSL version. Without this, it is possible for the function to roll off the end without a return statement.

[dcillera]

The ssl_ctx_client_hello_cb() callback, used in the implementation for SSL_CTX_set_select_certificate_cb(), needs to be modified to handle an additional ssl_select_cert_disable_ech enumerator that has been added in the new BoringSSL version. Without this, it is possible for the function to roll off the end without a return statement.

Yes but what value to be returned in that case? only ossl_SSL_CLIENT_HELLO_RETRY seems feasible (only 3 values available in OpenSSL)

[tedjpoole]

Some fixes needed in SSL_get_all_cipher_names(), SSL_get_all_signature_algorithm_names() and SSL_get_all_curve_names()

[tedjpoole]

The ssl_ctx_client_hello_cb() callback, used in the implementation for SSL_CTX_set_select_certificate_cb(), needs to be modified to handle an additional ssl_select_cert_disable_ech enumerator that has been added in the new BoringSSL version. Without this, it is possible for the function to roll off the end without a return statement.

None of the Envoy code ever returns the new ssl_select_cert_disable_ech enumerator, so if we do see it we should just raise a "this should never happen" error, and return ossl_SSL_CLIENT_HELLO_ERROR to stop the handshake, something like:

    case ssl_select_cert_disable_ech: {
      bssl_compat_error("Unexpected ssl_select_cert_disable_ech result from callback");
      return ossl_SSL_CLIENT_HELLO_ERROR;
    }

[tedjpoole]

Great work