RFC 5929: Channel Bindings for TLS: tls-server-end-point support

Dear @aws team,

Can you add the missing "tls-server-end-point" support of RFC 5929: Channel Bindings for TLS?
- https://datatracker.ietf.org/doc/html/rfc5929
- https://www.rfc-editor.org/rfc/rfc5929#section-4

Recently, @simo5 explains why it is needed here: https://mailarchive.ietf.org/arch/msg/kitten/-hhno2IUJQwXOyJT3-CTaKxoOuA/

- XEP-0388: Extensible SASL Profile: https://xmpp.org/extensions/xep-0388.html
- XEP-0440: SASL Channel-Binding Type Capability: https://xmpp.org/extensions/xep-0440.html
- XEP-0474: SASL SCRAM Downgrade Protection: https://xmpp.org/extensions/xep-0474.html
- XEP-0480: SASL Upgrade Tasks: https://xmpp.org/extensions/xep-0480.html

Little details, to know easily:
- tls-unique for TLS =< 1.2 (RFC5929)
- tls-server-end-point =< 1.2 + 1.3 (RFC5929)
- tls-exporter for TLS = 1.3 (RFC9266)

After the jabber.ru MITM, it is time to add it:
- https://notes.valdikss.org.ru/jabber.ru-mitm/
- https://snikket.org/blog/on-the-jabber-ru-mitm/
- https://www.devever.net/~hl/xmpp-incident
- https://blog.jmp.chat/b/certwatch/certwatch

Thanks in advance.

Linked to:
- Channel Binding: https://github.com/scram-sasl/info/issues/1

No files, tests, or entry points are named. Start by tracing the Go daemon's LDAP and Kerberos authentication flow to find where TLS channel binding is handled, then read RFC 5929 section 4. Done means the implementation supports tls-server-end-point for the relevant TLS versions and includes tests demonstrating the behavior.

Written by the indexing model from the issue text.