nghttpx supports multiple certificates using --subcert option.
Previously, SNI hostname is used to select certificate.  With this
commit, signature algorithm presented by client is also taken into
consideration.  nghttpx now accepts certificates which share the same
hostname (CN, SAN), but have different signature algorithm (e.g.,
ECDSA+SHA256, RSA+SHA256).

Currently, this feature requires OpenSSL >= 1.0.2.  BoringSSL, and
LibreSSL do not work since they lack required APIs.

close_stream erases from streams_ while it's being iterated over.

The destructor will already clean this structure up.

nghttpx: Add frontend-tls parameter to backend to require client TLS

LibreSSL removed PSK
Signed-off-by: Bernard Spil <brnrd@FreeBSD.org>