pgsql: ssl: Don't disable SSL for all hosts when one SNI host fails to

ssl: Don't disable SSL for all hosts when one SNI host fails to load

On Windows and in EXEC_BACKEND builds every backend reloads the SSL
configuration, with no previous one to fall back on. If a single
pg_hosts.conf entry failed to load there, the whole configuration was
discarded and the backend ran without SSL for every host. Fix by
keeping the failed entry without an SSL context in child processes
and failing the handshake only for connections selecting it.

Also document that SSL_passphrase_cmd_reload must be enabled on
Windows, like commit 0f4f45772c5 did for the GUC.

Author: Zsolt Parragi <zsolt(dot)parragi(at)percona(dot)com>
Reviewed-by: Daniel Gustafsson <daniel(at)yesql(dot)se>
Discussion: https://postgr.es/m/CAN4CZFM-Hn7-bdKC8=xwCQiE128Y1Xao+aft=Grq5QA9OkZ9Kw@mail.gmail.com
Backpatch-through: 19

Branch
------
REL_19_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/9674c91aeb2abbdf3a73f833b3f5ad7e87c5fe77

Modified Files
--------------
doc/src/sgml/runtime.sgml | 10 ++++++++++
src/backend/libpq/be-secure-openssl.c | 24 +++++++++++++++++++++++-
src/test/ssl/t/004_sni.pl | 32 ++++++++++++++++++++++++++++++++
3 files changed, 65 insertions(+), 1 deletion(-)