fix: release OpenSSL peer certificates after authentication

[rgerhards]

What

• release the reference returned by SSL_get_peer_certificate() on every peer-authentication exit path
• make the existing TLS Valgrind test fail on definite leaks

Why

OpenSSL returns an owned X509 reference from SSL_get_peer_certificate(). The peer-authentication path retained that reference after every certificate-authenticated connection, causing per-connection memory growth.

Impact

This changes only OpenSSL peer-certificate cleanup. Authentication behavior and the public ABI are unchanged.

Checks

• OpenSSL-only debug build
• make -j60 check: 29 passed, 1 skipped
• leak-enabled tls-basic-vg.sh: passed

---

Summary by cubic

Fixes a memory leak by releasing the OpenSSL peer certificate after authentication and makes the TLS Valgrind test fail on definite leaks. No behavior or ABI changes.

• Bug Fixes
  • Free the X509 returned by SSL_get_peer_certificate() on all peer-auth exit paths.
  • Tighten the TLS Valgrind test to error on definite leaks with stricter flags.

^{Written for commit 96e23cc. Summary will update on new commits.}