tls,quic: commonize TLS cert handling between tls, dtls & quic

[pimterry]

We are currently maintaining 3 different layers over OpenSSL's TLS API (node:tls/quic/dtls), which all reimplement the same things in subtly different ways, and will require any fixes to be applied 3x.

This is a first step towards commonizing them to share logic & options directly. Medium term, I want to end up with one API shape for TLS configuration (very close to current node:tls, maybe some additions from QUIC/DTLS) with a 95% shared implementation (some small exceptions for real protocol configuration divergences - but the exposed set of these is small). Consider this a first step and demo to discuss if people are on board. CC @nodejs/crypto.

This PR focuses on cert management:

• Extracts node:tls CA & cert store logic into separate helpers
• Uses them in node:quic and node:dtls, dropping the custom equivalents

This notably fixes a few bugs en route:

• node:quic ran SSL_CTX_set_default_verify_paths every time it initialized a context, doing IO every time, then throwing the configuration away with the subsequent SSL_CTX_set_cert_store call.
• node:dtls ignored the configured Node CA settings.
• node:dtls didn't list trusted client CAs in the server handshake response for mtls.

These are all fixed by reusing the existing logic. The helpers are direct moves, so this shouldn't change node:tls behaviour at all - it just changes the other modules to use them. Behaviour of DTLS & QUIC will change in small ways, but only to align with node:tls.

[nodejs-github-bot]

Review requested:

• @nodejs/crypto
• @nodejs/gyp
• @nodejs/quic

[codecov]

Codecov Report

❌ Patch coverage is 73.33333% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.14%. Comparing base (fe5037b) to head (fd023cb).
⚠️ Report is 268 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_tls_certificates.cc	71.15%	4 Missing and 11 partials ⚠️
src/crypto/crypto_context.cc	87.50%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #64711      +/-   ##
==========================================
- Coverage   90.14%   90.14%   -0.01%     
==========================================
  Files         741      744       +3     
  Lines      242246   242334      +88     
  Branches    45621    45628       +7     
==========================================
+ Hits       218381   218460      +79     
+ Misses      15370    15365       -5     
- Partials     8495     8509      +14     

Files with missing lines	Coverage Δ
src/crypto/crypto_context.h	100.00% <ø> (ø)
src/crypto/crypto_context.cc	72.14% <87.50%> (-0.13%)	⬇️
src/crypto/crypto_tls_certificates.cc	71.15% <71.15%> (ø)

... and 62 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/75663/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/75691/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/75704/

[avivkeller]

Landed in e79c6b3

[aduh95]

Adding the dont-land labels since this is based on #63182