tls: defer re-entrant calls to SSL state machine from JS

[pimterry]

This is a step towards #65035: making sure that we never mess with the OpenSSL/BoringSSL state machine from inside it.

Rather than hooking each of our callbacks/events inside the SSL library scope, I've wrapped each call that goes into OpenSSL at the top level, and then I'm checking against this in DoWrite, DoShutdown and Cycle, which can be triggered from JS. In each case, if we're inside the SSL library scope (which means we're being called from a JS callback that was triggered by the SSL library) then we defer.

This covers some cases that currently work by luck but will break soon in BoringSSL and some cases that already fail today, like the ALPNCallback write example (see #65035 for details).

This just covers SSL_read/SSL_write/SSL_shutdown which are impacted by the pending BoringSSL patch, we may need to review other SSL_set... calls as well later.

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[codecov]

Codecov Report

❌ Patch coverage is 79.74684% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.15%. Comparing base (fe4a42b) to head (c03259b).
⚠️ Report is 55 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_tls.cc	78.08%	6 Missing and 10 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65105      +/-   ##
==========================================
- Coverage   90.18%   90.15%   -0.03%     
==========================================
  Files         771      771              
  Lines      264911   265513     +602     
  Branches    50309    50484     +175     
==========================================
+ Hits       238919   239385     +466     
- Misses      16966    17054      +88     
- Partials     9026     9074      +48     

Files with missing lines	Coverage Δ
src/crypto/crypto_tls.h	90.00% <100.00%> (+2.50%)	⬆️
src/crypto/crypto_tls.cc	78.44% <78.08%> (-0.33%)	⬇️

... and 67 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pimterry]

@nodejs/crypto some eyes on this would be helpful. This fixes various cases (see tests) where using a TLS socket from inside our own callbacks breaks Node today, due to bad behaviour that BoringSSL is planning to soon directly guard against: https://boringssl-review.googlesource.com/c/boringssl/+/97087.

#65035 has the full context.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/77239/