Fixes netty#985.

Netty calls SSL.setKeyMaterial in its server-side certificate
callback (https://docs.openssl.org/3.6/man3/SSL_CTX_set_cert_cb/ but
the same going back to 1.0.2). OpenSSL invokes certificate callbacks
after the server receives a ClientHello.

TLS 1.2 TLS sessions usually had one ClientHello, so this callback
would usually run once. TLS 1.3, however, might begin a session with
multiple ClientHellos as the result of
HelloRetryRequests. SSL.setKeyMaterial adds chained
certificates (intermediates and roots) to the per-connection SSL
struct with SSL_add1_chain_certs. This function appends certificates,
so every time a ClientHello arrives, setKeyMaterial would re-add the
same chain. Finicky clients fail if they receive the same intermediate
twice.

This change allows netty-tcnative to talk TLS 1.3 with these
clients. It clears the SSL struct's certificate chain (that is,
everything after the certificate assigned with SSL_use_certificate) on
every setKeyMaterial call. Multiple ClientHellos will result in the
same key meterial appearing in Certificate responses.

Note that this should improve correctness for TLS 1.2, as well, since
renegotiation for e.g. rekeying would have suffered from the same
duplicate intermediates issue.

Co-authored-by: Norman Maurer <norman_maurer@apple.com>