Async cert-auth fails on TLS 1.3: set post_handshake_auth on the SSL context (+ optional TLS 1.3 enforcement)

[DanPeterson]

Summary

SPP 9.0 enables TLS 1.3. The async client cannot complete certificate authentication over TLS 1.3: async_client.py::_create_ssl_context builds the SSLContext and loads the client certificate but never enables post-handshake authentication, so it does not respond to the server''s post-handshake CertificateRequest and auth fails (error 60094). The sync client is unaffected because requests/urllib3 enables post_handshake_auth on its default context.

Changes

1. Bugfix -- enable post-handshake auth (async)

In async_client.py::_create_ssl_context, set ctx.post_handshake_auth = True when a client certificate is loaded. This is the one change required for async cert-auth to work on 9.0.

2. Optional TLS 1.3 enforcement

Add an opt-in to require TLS 1.3 (ctx.minimum_version = ssl.TLSVersion.TLSv1_3) on both sync and async clients. Default is unchanged (negotiated).

3. HTTP/1.1

Cert-based auth requires HTTP/1.1 (HTTP/2 disallows the post-handshake certificate request). Both requests (sync) and aiohttp (async) already default to HTTP/1.1; keep it and do not enable HTTP/2.

4. Test coverage

Add an async certificate-auth integration test (tests/integration/test_certificate_auth.py / test_a2a.py) that exercises TLS 1.3 to prevent regression.

Acceptance criteria

1. Async cert-auth (password, cert, and A2A retrieval) succeeds against a 9.0 appliance over TLS 1.3.
2. Sync cert-auth continues to work.
3. With TLS 1.3 enforcement enabled, sub-1.3 connections fail; cert-auth still succeeds at 1.3 on both clients.
4. Requests use HTTP/1.1.

Testing

Validate against a live 9.0 appliance: async and sync certificate auth and A2A credential retrieval.