Add a new allowLegacyUnsafeRenegotiation property to SecurityContext

[brianquinlan]

Change

I propose that we add a new boolean allowLegacyUnsafeRenegotiation property to SecurityContext.

If set, it would allow client sockets to renegotiate TLS connections if requested to by the server (see #47841).

Rationale

The SecurityContext API is already property based and implementing this as a constructor argument would be inconsistent with the rest of the API (where the only constructor argument is one that cannot be logically set after construction). Also, parameterizing all future functionality as constructor arguments does not seem scalable.

Impact

All classes that implements SecurityContext (without extends Mock or equivalent noSuchMethod implementation) will need to be updated.

There are no such classes in Flutter or at Google.

Mitigation

Users must implement the allowLegacyUnsafeRenegotiation property.

[brianquinlan]

Devon has limited bandwidth so I'll ask for sign-off directly (counter to process):

@vsmenon, @Hixie, and @grouma - can you review and sign off for Dart, Flutter, and AngularDart respectively? Thanks!

[grouma]

I could not find any usages of SecurityContext in AngularDart. In fact the only usages of implements SecurityContext I could find were in the SDK.

[Hixie]

Fine by me.

[vsmenon]

lgtm

[brianquinlan]

Fixed in c286b76