tls: preserve TlsAccept compatibility while surfacing certificate callback errors

[Rhovian]

Summary

• add certificate_callback_result() as an opt-in Result<()> hook for explicit certificate selection failures
• keep the legacy certificate_callback() API unchanged and delegate to it by default for backward compatibility
• surface callback failures as TLSHandshakeFailure with clearer context
• add tests covering legacy delegation, explicit callback rejection, and precedence when both callback methods are implemented

Why

closes #838 calls out poor diagnostics when async certificate selection fails during the OpenSSL/BoringSSL handshake. This change improves the explicit error-reporting path without breaking existing TlsAccept implementations.

Scope

This intentionally does not address the separate case where a callback returns Ok(()) without installing certificate material. That still falls through to resume_accept() today and would require inspecting SSL state after the callback, which is a more invasive follow-up.

Validation

• cargo test -p pingora-core test_async_cert --features openssl -- --nocapture
• cargo test -p pingora-core test_async_cert_result_is_authoritative --features openssl -- --nocapture

cc: @johnhurt