feat: support tls-server-end-point channel binding for SCRAM-SHA-256

[conradludgate]

Postgres supports "channel bindings" for SCRAM-SHA-256 authentication. This prevents certain MITM attacks. This authentication is known as "SCRAM-SHA-256-PLUS".

• https://datatracker.ietf.org/doc/html/rfc5802#section-6
• https://www.postgresql.org/docs/17/sasl-authentication.html#SASL-SCRAM-SHA-256

Postgres supports the "tls-server-end-point" channel binding form which is derived by hashing the raw bytes of the first certificate sent by the server in the TLS handshake.

• https://datatracker.ietf.org/doc/html/rfc5929#section-4

Postgres also supports "requiring" channel binding. This additionally prevents a MITM sending cleartext the chosen authentication mechanism.

• https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNECT-CHANNEL-BINDING

Related to #1145

[Neustradamus]

Dear @conradludgate,

I have discovered today by chance your PR, one year after, nice, good job! :)

Dear @lib team, @fdr, @otan, @Johnto, @rafiss: Have you seen this PR?

It is solves not fully:

• RFC 9266: Channel Bindings for TLS 1.3 support #1145