…h session tickets (netty#14404)

Motivation:
If TLS is `OPTIONAL` then there won't always be a verified peer.
This means there will be no calls on the server `TrustManager` to check
if the client is trusted.
That makes it look like a resumed session to the resumption controller.
But there won't be any verified peer on the session, and trying to get
the peer certificates will throw an exception.

It's also a valid configuration to enable session tickets with TLSv1.2,
and doing so makes a meaningful change to the `SSLEngine` behavior that
we need to test for.

Modification:
- Collect the OpenSSL parameterization code for `SSLEngineTest`.
- Add tickets being enabled or not as a parameter.
- Fix a test that did not anticipate the session ticket behavior.
- Make the `ResumptionController` consider if the engine is in client
mode, or if it requires client authentication, and only propagate
`SSLPeerUnverifiedException` if so.
- Make the `ResumptionController` swallow the
`SSLPeerUnverifiedException` when client auth is OPTIONAL or NONE.
- Add a test for this scenario.

Result:
We now have test coverage with TLSv1.2 session tickets.
The `ResumableX509ExtendedTrustManager` interface can now be used
together with `ClientAuth.OPTIONAL`.

…ate tasks (netty#14411)

Motivation:
When doing a TLSv1.3 handshake with delegate task execution, clients may
complete the handshake in a delegate task wrap that does _not_ any data
written during the handshake. A subsequent unwrap of server response
data is then supposed to let the pending user data flow through to
wrapping - the `wrapLater` flag is tracking this - however, this does
not happen because the unwrap notices that the handshake promise has
already been completed by the earlier wrap call. The unwrap then
assumes, incorrectly, that not only has downstream been notified, but
user data has also been wrapped.

Modification:
The unwrap call should always attempt to wrap later, if the handshake is
finished or not handshaking, and we have pending user data to wrap.

Result:
No more data processing stalls on the client-side, after a TLSv1.3
handshake with task delegation. This also fixes the frequent test
timeouts from `SSLEngineTest.mustCallResumeTrustedOnSessionResumption`,
which was running into this exact scenario.