bug: `tcpsock:getsslsession()` returns "not resumable" with BoringSSL (TLS 1.3), breaking session reuse tests

When running lua-nginx-module with BoringSSL, tcpsock:getsslsession() frequently returns:

failed to get SSL session: not resumable

This causes t/170-ssl-session-reuse.t (and similar session-reuse flows) to fail under BoringSSL, while OpenSSL may pass.

POC Test

# vim:set ft= ts=4 sw=4 et fdm=marker:

use Test::Nginx::Socket::Lua;

repeat_each(1);

my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
my $openssl_version = eval { `$NginxBinary -V 2>&1` };

if ($openssl_version !~ m/running with BoringSSL/) {
    plan(skip_all => "this POC only targets BoringSSL");
} else {
    plan tests => repeat_each() * (blocks() * 3);
}

$ENV{TEST_NGINX_SERVER_SSL_PORT} ||= 12345;

log_level 'debug';
no_long_string();

run_tests();

__DATA__

=== TEST 1: getsslsession is not resumable on BoringSSL with TLSv1.3
--- http_config
    server {
        listen $TEST_NGINX_SERVER_SSL_PORT ssl;
        server_name test.com;
        ssl_certificate ../../cert/test.crt;
        ssl_certificate_key ../../cert/test.key;
        ssl_protocols TLSv1.3;

        location / {
            return 201;
        }
    }
--- config
    lua_ssl_protocols TLSv1.3;

    location /t {
        content_by_lua_block {
            local sock = ngx.socket.tcp()
            sock:settimeout(2000)

            local ok, err = sock:connect("127.0.0.1", $TEST_NGINX_SERVER_SSL_PORT)
            if not ok then
                ngx.say("failed to connect: ", err)
                return
            end

            ngx.say("connected: ", ok)

            local sess
            sess, err = sock:sslhandshake()
            if not sess then
                ngx.say("failed to do SSL handshake: ", err)
                return
            end

            ngx.say("ssl handshake: ", type(sess))

            local bytes
            bytes, err = sock:send("GET / HTTP/1.1\r\nHost: test.com\r\nConnection: close\r\n\r\n")
            if not bytes then
                ngx.say("failed to send http request: ", err)
                return
            end

            local line
            line, err = sock:receive()
            if not line then
                ngx.say("failed to receive response status line: ", err)
                return
            end

            ngx.say("received: ", line)

            sess, err = sock:getsslsession()
            if not sess then
                ngx.say("failed to get SSL session: ", err)
            else
                ngx.say("ssl session: ", type(sess))
            end

            ok, err = sock:close()
            ngx.say("close: ", ok, " ", err)
        }
    }
--- request
GET /t
--- response_body_like chop
\Aconnected: 1
ssl handshake: cdata
received: HTTP/1.1 201 Created
failed to get SSL session: not resumable
close: 1 nil
\z
--- no_error_log
[error]
--- timeout: 5

Start with t/170-ssl-session-reuse.t and the supplied BoringSSL TLS 1.3 reproducer, then trace the tcpsock sslhandshake() and getsslsession() paths. Compare the session handling under BoringSSL and OpenSSL. Done means the BoringSSL session-reuse flow no longer reports "not resumable" while the existing session-reuse tests continue to pass.