fix(ext/node): implement ALPNCallback and SNICallback for TLS server

[bartlomieju]

Summary

Implements ALPNCallback and SNICallback options for node:tls.createServer(), which were previously accepted but never invoked.

• ALPNCallback: Called during TLS handshake with the client's offered protocols, returns the selected protocol
• SNICallback: Called with the client's SNI hostname, returns a SecureContext for certificate selection
• getServername(): Now returns the client's SNI on server-side TLS connections
• Validation: ERR_TLS_ALPN_CALLBACK_WITH_PROTOCOLS when both ALPNCallback and ALPNProtocols are set, ERR_TLS_ALPN_CALLBACK_INVALID_RESULT when callback returns a protocol not in the client's list
• Alert mapping: NoApplicationProtocol alert now correctly maps to ERR_SSL_TLSV1_ALERT_NO_APPLICATION_PROTOCOL

Approach

Uses rustls's Acceptor API to intercept the ClientHello before creating the ServerConnection. This allows extracting SNI and ALPN from the client hello, calling back to JS for callback-based selection, then building a per-connection ServerConfig. The existing fast path (direct ServerConnection::new) is preserved when no callbacks are set.

Closes #33346

Test plan

• New spec tests: tests/specs/node/tls_alpn_sni_callbacks/ (ALPNCallback, SNICallback, both together)
• Existing TLS tests pass (tls_jsstreamsocket_close, tls-connect-simple)
• Static ALPNProtocols (without callback) still works
• cargo clippy clean