HTTPS proxy connection reuse lets one easy handle inherit another handle's mTLS-authenticated proxy session

Summary: libcurl can reuse an already mTLS-authenticated HTTPS proxy TLS connection for a different easy handle even when that second handle does not have the proxy private key required to establish the session itself. The issue happens because the HTTPS proxy connection reuse identity does not …

   TMPDIR="$(mktemp -d)"
   trap 'rm -rf "$TMPDIR"' EXIT
   CERTDIR="$TMPDIR/certs"
   mkdir -p "$CERTDIR"

   cat >"$TMPDIR/server.py" <<'PY'
   #!/usr/bin/env python3
   import socket
   import ssl
   import sys

   def recv_headers(sock, pending):
       while b"\r\n\r\n" not in pending: …