enable auto setting of SNI based on host header

[jmcclelland]

Enable SNI to be auto set to the Host header.

This is a proof of concept for resolving #424. I am happy to continue polishing it if it seems like the right way to go.

Checklist:

• Added a description of the changes to the [Unreleased] section of docs/docs/CHANGELOG.md
• Added test cases to the relevant parts of the codebase
• Ran integration tests npm run test:integration (unsupported on Windows, please use WSL)
• All of my commits have verified signatures

[Xe]

LGTM, do you know how I would go about testing this?

[jmcclelland]

I'm not sure how to do it in a simple way. I am manually testing by running an Apache2 backend with:

• CVE-2025-23048 resolved (e.g. apache2 package in Debian Bullseye version 2.4.65-1~deb12u or Debian Trixie version 2.4.65-2) so apache2 enforces a requirement that an SNI host is provided.
• More than one virtual host configured with different ServerName's but sharing the same IP/Port combo (I'm not sure if this is required)

The anubis configuration includes an https target e.g.:

TARGET=https://1.2.3.4
TARGET_INSECURE_SKIP_VERIFY=true

Without this patch, I get error 421:

Misdirected Request:
    The client needs a new connection for this request as the
    requested host name does not match the Server Name Indication
    (SNI) in use for this connection.

With the patch it works (and also I can remove TARGET_INSECURE_SKIP_VERIFY).

[jmcclelland]

@Xe I just polished up the commit to add more documentation. I'm a bit at a loss as to how to write a test for it (sorry, go is not my strong suit) - but if you can point me to any existing tests that check backend end connections maybe I can piece something together.