Reject TLS 1.3 early data when PSK ciphersuite differs

Reject TLS 1.3 early data when PSK ciphersuite differs

TLS 1.3 PSK resumption can use any ciphersuite with the same hash, but 0-RTT
acceptance requires the selected ciphersuite to match the one associated with
the selected PSK.

Keep same-hash PSK resumption working and reject only early data on a
ciphersuite mismatch. Document the user-visible fix in CHANGES.md.

Also updated RFC8446 references in ssl/*.[ch] code comments to corresponding
RFC9846 locations.

Fixes #31803

Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Aug  5 08:16:57 2026
(Merged from https://github.com/openssl/openssl/pull/32032)