RFC 9266: Channel Bindings for TLS 1.3 support

[Neustradamus]

Dear @lib pq team,

Can you add the support of RFC 9266: Channel Bindings for TLS 1.3?

• https://datatracker.ietf.org/doc/html/rfc9266

Channel Bindings for TLS: https://datatracker.ietf.org/doc/html/rfc5929

• XEP-0388: Extensible SASL Profile: https://xmpp.org/extensions/xep-0388.html
• XEP-0440: SASL Channel-Binding Type Capability: https://xmpp.org/extensions/xep-0440.html
• XEP-0474: SASL SCRAM Downgrade Protection: https://xmpp.org/extensions/xep-0474.html
• XEP-0480: SASL Upgrade Tasks: https://xmpp.org/extensions/xep-0480.html

Little details, to know easily:

• tls-unique for TLS =< 1.2 (RFC5929)
• tls-server-end-point =< 1.2 + 1.3 (RFC5929)
• tls-exporter for TLS = 1.3 (RFC9266)

After the jabber.ru MITM, it is time to add it:

• https://notes.valdikss.org.ru/jabber.ru-mitm/
• https://snikket.org/blog/on-the-jabber-ru-mitm/
• https://www.devever.net/~hl/xmpp-incident
• https://blog.jmp.chat/b/certwatch/certwatch

Thanks in advance.

Linked to:

• Channel Binding: State of Play scram-sasl/info#1
• Feature request: Add support for SCRAM-SHA-256 password authentication #817
• Use a safe implementation of SCRAM. #914
• Support scram password generation #941
• Add support for SCRAM-SHA-256 authentication. #608
• Inform user of unsupported scram auth method #621
• Support for SCRAM-SHA-256 authentication #788
• Add SCRAM-SHA-256 authentication to this library #833

[Neustradamus]

@conradludgate has done a PR here:

• feat: support tls-server-end-point channel binding for SCRAM-SHA-256 #1181

We can thank @conradludgate for this good job about tls-server-end-point!
It does not add tls-exporter yet but a big improvement!

cc: @lib team, @fdr, @otan, @Johnto, @rafiss.