MDEV-31855 SSL cert validation protocol extension

* extend the client auth plugin API with a new callback
* relax the plugin version check to allow load a plugin with the
  same major version, even if the minor versions differ
* implement the protocol extension:
  - don't abort at once if the certificate is self signed and
    no CA was explicitly specified
  - allow it if it passes fingerprint check
  - allow it if plugin has hash_password_bin callback, password was
    non-empty and the control hash matches server's

libmariadb/mariadb_lib.c

@@ -1440,6 +1440,8 @@ mysql_real_connect(MYSQL *mysql, const char *host, const char *user,
   if (!mysql->options.extension || !mysql->options.extension->status_callback)
     mysql_optionsv(mysql, MARIADB_OPT_STATUS_CALLBACK, NULL, NULL);
 
+  reset_tls_self_signed_error(mysql);
+
   /* if host contains a semicolon, we need to parse connection string */
   if (host && strchr(host, ';'))
   {
@@ -2444,6 +2446,7 @@ mysql_close(MYSQL *mysql)
     mysql_close_memory(mysql);
     mysql_close_options(mysql);
     ma_clear_session_state(mysql);
+    reset_tls_self_signed_error(mysql);
 
     if (mysql->net.extension)
     {