[bpo-28414] Make all hostnames in SSL module IDN A-labels (GH-5128) (GH-5843)

[bpo-28414] Make all hostnames in SSL module IDN A-labels (GH-5128) (GH-5843)

Previously, the ssl module stored international domain names (IDNs)
as U-labels. This is problematic for a number of reasons -- for
example, it made it impossible for users to use a different version
of IDNA than the one built into Python.

After this change, we always convert to A-labels as soon as possible,
and use them for all internal processing. In particular, server_hostname
attribute is now an A-label, and on the server side there's a new
sni_callback that receives the SNI servername as an A-label rather than
a U-label.
(cherry picked from commit 11a1493bc4198f1def5e572049485779cf54dc57)

Co-authored-by: Christian Heimes <christian@python.org>