Prevent SSL errors on fallback cert

Is there a way to prevent the Nginx instance from serving (or serving an error page) when the `allow_domain` function returns false?

Right now it serves up a proxied page from my upstream service - I would like to short-circuit this and return 404 or some error page/response from Nginx.

See the config below:
```
user www-data;
worker_processes auto;
pid /run/openresty.pid;

#pid logs/nginx.pid;

events {

worker_connections 1024;
}

http {

include mime.types;
default_type application/octet-stream;

lua_shared_dict auto_ssl 1m;
lua_shared_dict auto_ssl_settings 64k;

resolver 8.8.8.8 ipv6=off;

init_by_lua_block {
auto_ssl = (require "resty.auto-ssl").new()
auto_ssl:set("allow_domain", function(domain)
#FIND My valid domains and if found return true else false
end)

auto_ssl:init()
}

init_worker_by_lua_block {

auto_ssl:init_worker()
}

#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/openresty/access.log;
error_log /var/log/openresty/error.log;

sendfile on;
#tcp_nopush on;

#keepalive_timeout 0;
keepalive_timeout 65;

gzip on;

server {

listen 80 default_server;
listen [::]:80 default_server;
server_name _;

location /.well-known/acme-challenge/ {

content_by_lua_block {

auto_ssl:challenge_server()
}
}

return 301 https://$host$request_uri;
}

server {

listen 443 ssl;
ssl_certificate_by_lua_block {

auto_ssl:ssl_certificate()
}

location / {

proxy_ssl_server_name on;
proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
proxy_pass https://mydomain.com/$host;
}

ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;
}

server {

listen 127.0.0.1:8999;

client_body_buffer_size 128k;
client_max_body_size 128k;

location / {

content_by_lua_block {

auto_ssl:hook_server()
}
}
}

}
```

Start by tracing the `allow_domain` callback through `ssl_certificate_by_lua_block` and `auto_ssl:ssl_certificate()`, using the provided fallback certificate and proxy location as the reproduction setup. Determine how a false result should affect the TLS request, then verify with the shown Nginx configuration that disallowed domains no longer reach the upstream and produce the agreed error response.

Written by the indexing model from the issue text.