Add support for TLS Certificate Compression (RFC 8879)

[maskit]

Compression/decompression won't be used by default. Setting at least one algorithm enables it.

New settings:

• proxy.config.ssl.server.cert_compression.algorithms
• proxy.config.ssl.client.cert_compression.algorithms

proxy.config.ssl.server.cert_compression.cache is going to be added on next PR.

New metrics:

• proxy.process.ssl.cert_compress.<alg>
• proxy.process.ssl.cert_compress.<alg>_failure
• proxy.process.ssl.cert_decompress.<alg>
• proxy.process.ssl.cert_decompress.<alg>_failure

Autest:

The test launches two ATS processes, and use compression between them, because there isn't a good client that supports the compression.

[ezelkow1]

[approve ci]

[Copilot]

Pull request overview

Adds TLS Certificate Compression (RFC 8879) support to ATS (behind new configuration knobs and feature detection), with counters/metrics and an autest that validates compression/decompression between two ATS instances.

Changes:

• Introduces config records to enable certificate compression algorithms for server/client TLS contexts.
• Wires certificate compression registration into server (SSLMultiCertConfigLoader) and client (SSLInitClientContext) SSL_CTX initialization.
• Adds per-algorithm compress/decompress success/failure metrics plus docs and a gold test.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
tests/gold_tests/tls/tls_cert_comp.test.py	New gold test that runs edge↔mid TLS with cert compression enabled and checks metrics.
tests/gold_tests/tls/replay/tls_cert_compression.replay.yaml	Replay definition used by verifier server/client in the new test.
src/traffic_layout/info.cc	Adds TS_HAS_CERT_COMPRESSION feature flag output based on TLS library capabilities.
src/records/RecordsConfig.cc	Registers new proxy.config.ssl.{server,client}.cert_compression.algorithms records.
src/iocore/net/TLSCertCompression.h	Declares certificate compression registration API.
src/iocore/net/TLSCertCompression.cc	Implements registration logic for supported TLS library APIs.
src/iocore/net/TLSCertCompression_zlib.h/.cc	Adds zlib compression/decompression callbacks + metrics increments.
src/iocore/net/TLSCertCompression_brotli.h/.cc	Adds brotli compression/decompression callbacks + metrics increments.
src/iocore/net/TLSCertCompression_zstd.h/.cc	Adds zstd compression/decompression callbacks + metrics increments.
src/iocore/net/SSLUtils.cc	Enables cert compression for server contexts during multicert load.
src/iocore/net/SSLClientUtils.cc	Enables cert compression preference for client SSL_CTX initialization.
src/iocore/net/SSLStats.h / src/iocore/net/SSLStats.cc	Adds/initializes new cert compression/decompression counters.
src/iocore/net/SSLConfig.cc	Loads new config values into SSLConfigParams and frees them on cleanup.
src/iocore/net/P_SSLConfig.h	Adds fields to hold configured algorithm lists.
include/iocore/net/SSLMultiCertConfigLoader.h	Declares new _enable_cert_compression() hook.
src/iocore/net/CMakeLists.txt	Adds new sources and links brotli/zstd libs when available.
cmake/Findbrotli.cmake	Adds brotlidec discovery + imported target for decoder library.
include/tscore/ink_config.h.cmake.in	Adds generated feature macros for cert compression APIs.
CMakeLists.txt	Detects cert compression symbols in the TLS library headers.
doc/admin-guide/monitoring/statistics/core/ssl.en.rst	Documents new cert compression/decompression metrics.
doc/admin-guide/files/records.yaml.en.rst	Documents the new configuration records and supported values.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 8 comments.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.