THRIFT-6233: Use the peer-address matcher in TSSLServerSocket on every Python

[slachiewicz]

JIRA: THRIFT-6233, THRIFT-6265
Client: py

TSSLServerSocket matches a client certificate against the address the connection arrived from, whenever cert_reqs asks for a certificate. Which function did that depended on the interpreter: sslcompat.match_peer_ipaddress on Python 3.12 and later, ssl.match_hostname on 3.11 and earlier. The two disagree. Only the former reduces an IPv4-mapped peer (THRIFT-6201); only the latter falls back to the commonName when the certificate has no subjectAltName. A dual-stack listener (host=None) reports an IPv4 client as ::ffff:127.0.0.1, so a certificate carrying 127.0.0.1 was accepted on 3.12 and refused on 3.10. THRIFT-3660 worked around that in 2016 by listing the mapped address in client_v3.crt; #3857 has to remove that entry because Go 1.27 rejects certificates that carry one.

The server only ever matches an IP address, so match_peer_ipaddress is now its default on every version. The check stays on by default and covers IP subjectAltName records only: an IPv4-mapped peer matches the plain address on every version, and a certificate without an IP subjectAltName is refused where ssl.match_hostname compared the commonName with the address string. DNS records are not matched, since a server has no name for its client. Which subjects may connect is the application's policy through validate_callback, which receives the getpeercert() dictionary and the peer address; the docstring shows a callback that refuses on the subject. TSSLSocket on the client side is unchanged.

The backports.ssl_match_hostname branch in sslcompat._optional_dependencies, the ValueError in TSSLServerSocket.__init__ that named it, and the setup.py dependency go, which is THRIFT-6265: the library requires Python 3, so nothing below 3.5 reaches them.

Tests drive TSSLServerSocket.accept() under the running interpreter: client_v3.crt is accepted, client.crt (no subjectAltName) is refused, a client arriving over IPv4 at a dual-stack listener is accepted with a certificate that carries 127.0.0.1 and no mapped entry (server.crt stands in as that certificate), and a caller-supplied callback refusing on the subject is honoured and receives the certificate and the peer address. lib/py/README.md records the change for 0.25.0.

Verified: test/test_sslsocket.py passes against this branch on Python 3.10, 3.11, 3.12, 3.13 and 3.14; against master's library on 3.10 the mapped-peer and default-callback tests fail, on 3.14 the default-callback test fails. flake8 --config setup.cfg reports the same 19 pre-existing E501 lines as master and none in the new code.

This change was created with AI assistance.

[slachiewicz]

Rebased on master (42d6fb0) to pick up the TNonblockingServerTest fix from THRIFT-6244 behind the AppVeyor failure. The diff is unchanged (same patch-id).