REGTESTS: ssl: add verifyhost SAN vs CN matching test

Add a VTC test to check that backend certificate verification in
ssl_sock_srv_verifycbk() adheres to RFC 6125:

1. A certificate with a matching SAN dNSName is accepted.
2. A legacy certificate without any SAN extension falls back to the
   Subject CN and is accepted.
3. A certificate with a non-matching SAN dNSName is rejected, even if
   its Subject CN matches the expected hostname.

The test uses dedicated static certificates in reg-tests/ssl/certs/
(verifyhost_ca.crt and associated leaf certificates) so that
certificates do not need to be generated at runtime.