GeezerVison

(cherry picked from commit 7dd8b47)

Co-authored-by: Christian Heimes [email protected]

Manual backport notes (3.12):

• Modules/_ssl.c: 3.12 predates _ssl.c calls SSL_CTX_get_verify_callback unnecessarily #113332, so _set_verify_mode() still fetched and re-installed the current ctx verify callback. It now installs _ssl_verify_callback directly, as on main (the unused verify_cb local is dropped; CPython never installs a callback of its own). newPySSLSocket()'s post-handshake-auth path already passes SSL_get_verify_callback() through, which is what main's hunk there introduces, so it is unchanged.
• Lib/test/test_ssl.py: 3.12 lacks main's LEAF_MISSING_AKI_* constants; the DISTRUSTED_SPKI_* block is placed after SIGNED_CERTFILE_ECC_HOSTNAME. The test itself is unchanged.
• Lib/test/certdata/make_ssl_certs.py: 3.12 predates the argparse cmdlineargs refactor, so make_distrusted_spki_cert() takes no arguments and uses the module-level enddate and literal '7000' days like the rest of the 3.12 script.
• Makefile.pre.in / PCbuild/_ssl.vcxproj{,.filters}: add only Modules/_ssl/distrusted_spki.h (main's _openssl_mem.h is main-only), plus the Header Files filter definition.

distrusted_spki.h, distrusted.zip and the NEWS entry are identical to main. test_ssl, test_asyncio.test_ssl and test_asyncio.test_sslproto pass, including test_distrusted_spki; no new _ssl.c compiler warnings.

• Issue: ssl: distrust compromised eMudhra intermediate CA keys #160040