Implement ECH (Encrypted Client Hello)

[JPeterMugaas]

It would be nice if we could implement ECH (Encrypted Client Hello).

Design Notes are available at:
https://github.com/openssl/openssl/blob/master/doc/designs/ech-api.md

[tregubovav-dev]

To begin implementing this functionality we need investigate several areas and prepare an design draft.
Below is an initial list of items for investigation:

• What Indy components would be supported:
  • Client components (TIdTCPClient and its descendants)
  • Server components (TIdTCPServer and its descendants)
• DNS infrastructure requirements
  • Client should be able to discover and validate ECH keys via Regular DNS querying HTTPS (Type 65) or SVCB (Type 64) record(s), or can do this via DoH request.
  • Server components should support external DNS server update or it can implement DoH service itself.
• OpenSSL API import and wrappers
  • Import ech.h types and routines
  • Design OPENSSL_STORE wrapper to support unified PKI Assets mechanism
  • Server components
    • Design ECH private key rotation mechanism
    • Design pluggable mechanism for ECH keys regeneration and DNS
    • Design OPENSSL_ECH_STORE wrapper to support loading ECH Assets
  • Client components
    • Design a custom DNS Resolver (by default OS resolvers may not resolve HTTPS or SVCB records).
    • Design a custom DoH client.