pgsql: ssl: Don't disable SSL for all hosts when one SNI host fails to

ssl: Don't disable SSL for all hosts when one SNI host fails to load

On Windows and in EXEC_BACKEND builds every backend reloads the SSL
configuration, with no previous one to fall back on. If a single
pg_hosts.conf entry failed to load there, the whole configuration was
discarded and the backend ran without SSL for every host. Fix by
keeping the failed entry without an SSL context in child processes
and failing the handshake only for connections selecting it.

Also document that SSL_passphrase_cmd_reload must be enabled on
Windows, like commit 0f4f45772c5 did for the GUC.

Author: Zsolt Parragi <zsolt(dot)parragi(at)percona(dot)com>
Reviewed-by: Daniel Gustafsson <daniel(at)yesql(dot)se>
Discussion: https://postgr.es/m/CAN4CZFM-Hn7-bdKC8=xwCQiE128Y1Xao+aft=Grq5QA9OkZ9Kw@mail.gmail.com
Backpatch-through: 19

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/07be6f384ca7a90c83055da46346e39a0b4d421d

Modified Files
--------------
doc/src/sgml/runtime.sgml | 10 ++++++++++
src/backend/libpq/be-secure-openssl.c | 24 +++++++++++++++++++++++-
src/test/ssl/t/004_sni.pl | 32 ++++++++++++++++++++++++++++++++
3 files changed, 65 insertions(+), 1 deletion(-)