tls: implement TLS session resumption

[marten-seemann]

It won't save any roundtrips, but a few bytes during the first flight, and we don't need to verify the certificate chain again.

[marten-seemann]

The Go standard library implementation doesn't allow us to modify the information that gets stored in the session ticket (there is a proposal to change that, but it seems to be inactive: golang/go#19199).

Furthermore, for every resumed connection, the server verifies the certificate chain again (and calls the VerifyPeerCertificate callback). I'm not sure what the reasoning behind this is, since tickets are encrypted and authenticated, so successful encryption of the ticket should prove that the certificate chain was already verified successfully in the previous handshake.

Since our motivation to do TLS session resumption is to save the computational cost of verifying the certificate chain in the first place, we wouldn't gain anything from implementing it, apart from (maybe) saving a few bytes during a resumed handshake. Considering that with non-RSA keys the TLS messages already fit into a single MTU, the benefit of that is miniscule.

[marten-seemann]

See golang/go#31641.