MINOR: ssl/cli: add negative filters to "show ssl sni"

MINOR: ssl/cli: add negative filters to "show ssl sni"

The 'show ssl sni' output can be confusing when using crt-list, because
the wildcards can be completed with negative filters, and they need to
be associated to the same line.

Having a negative filter on its line alone does not make much sense,
this patch adds a new 'Negative Filter' column that show the exception
applied on a wildcard from a crt-list line.