SNI: support for early ClientHello callback with BoringSSL.

This brings feature parity with OpenSSL after the previous change,
making it possible to set SSL protocols per virtual server.

src/stream/ngx_stream_ssl_module.c

@@ -559,6 +559,11 @@ ngx_stream_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
         return SSL_TLSEXT_ERR_OK;
     }
 
+    if (c->ssl->handshake_rejected) {
+        *ad = SSL_AD_UNRECOGNIZED_NAME;
+        return SSL_TLSEXT_ERR_ALERT_FATAL;
+    }
+
     s = c->data;
 
     if (arg) {