SSL verify partial chain

[andr-cher-scacap]

Problem

There was no dedicated regression coverage for the new
ssl_verify_client partial_chain mode.

Without targeted tests, it would be easy to regress the intended
behavior in one module while the others continue to pass.

Solution

Add focused regression tests for ssl_verify_client partial_chain in:

• HTTP
• stream
• mail (IMAP)

The tests build a small CA hierarchy with a self-signed root, an
intermediate signed by that root, and a leaf client certificate signed by
the intermediate. The root is intentionally not trusted by nginx, so the
tests specifically verify that partial_chain accepts the leaf
certificate when the trusted intermediate is present.

The tests also verify that:

• an unrelated certificate is rejected;
• the control case with ssl_verify_client on still rejects the same
  leaf certificate when only the intermediate is trusted;
• missing client certificates are rejected where partial_chain is
  expected to behave like on.

Testing

Validated with:

TEST_NGINX_BINARY=/path/to/nginx/objs/nginx prove -v \
    ssl_verify_client_partial_chain.t \
    stream_ssl_verify_client_partial_chain.t \
    mail_imap_ssl_partial_chain.t

Result: all 28 tests passed.

• Manual Testing
• Functional Testing (nginx-tests)

Closes: N/A

Checklist

Before submitting this PR, please confirm:

• I have read the contributing guidelines
• I have added tests (if applicable) to validate my changes
• All existing tests pass
• I have updated documentation where necessary
• My branch is rebased on the latest master
• This PR targets the master branch from my fork
• My commit message follows project standards and contains only
  relevant changes

Release Notes

Added regression coverage for the new ssl_verify_client partial_chain
mode in HTTP, stream, and mail.