httpConnectAgain should require the same X.509 certificate

[michaelrsweet]

httpConnectAgain doesn't make sure that the new connection is using the same X.509 certificate as the original connection. The new connection should either have the same certificate or pass strict cupsGetCredentialsTrust tests.

[michaelrsweet]

Will also investigate what can be done for 2.4.x, but that code has the old X.509 support code and isn't as capable.

[michaelrsweet]

Note: Since the connection address is cached in http_t, exploiting this issue is non-trivial.

[michaelrsweet]

Hmm, it looks like I fixed this a year ago!