tls: fix IPv6 hostname verification regression

[Paraspandey-debugs]

The previous normalization logic applied domainToASCII() to all hostnames, which returns an empty string for raw IPv6 addresses. This caused the IP SAN check to be skipped and verification to incorrectly fall back to domain matching. This patch moves the IP address check before any IDNA conversion, ensuring IPv6 (and IPv4) addresses are compared directly against the certificate's IP Subject Alternative Names.

Adds regression tests for IPv6 SAN verification.

Fixes: #64032

[nodejs-github-bot]

Review requested:

• @nodejs/crypto
• @nodejs/net

[Paraspandey-debugs]

Should i rewrite the commit message and then reopen a seperate PR ?

[tniessen]

@Paraspandey-debugs You can amend the commit locally and force-push to the same branch in your own repository (Paraspandey-debugs/main), which will update this PR.

[indutny]

Friendly ping on the issue. Looks like the bug slipped into Electron 43 and affects us. Thank you!

[pimterry]

Ah, does this duplicate #64145?

That's just been merged today and seems to be fixing the same issue, albeit in a slightly different way. Sorry @Paraspandey-debugs, I should have caught this sooner.

I think both would work - #64145 has some very minor advantages (for the common non-IP case it calls isIP once instead of twice) but AFAICT it's mostly a wash and either solves the issue. Anybody have any strong feeling either way?

[Paraspandey-debugs]

Thanks for the clarification @pimterry
I also took another look, and I agree the other PR's implementation is a bit more efficient.
Glad the issue is fixed either way :)
Thanks for taking the time to review both.

should i close the PR now ?

[jasnell]

Yeah I think it makes sense to close this one if it's a duplicate. Thank you for the work on it, however!