fetch: run checkServerIdentity before writing the request (#31325)

When `fetch()` is given a `tls.checkServerIdentity` callback, the
connection is now parked after the TLS handshake and the request
(headers and body) is only written once the callback has approved the
peer certificate. The callback runs on the first certificate-carrying
progress update — once per redirect hop, before that hop's request goes
out — instead of only after response metadata arrives. For an HTTPS
proxy, the proxy's own certificate is verified natively against the
proxy hostname instead of being handed to the user callback.

Adds tests covering: a rejecting callback resulting in zero plaintext
bytes reaching the server (direct TLS and CONNECT-tunneled), an
approving callback still round-tripping the request/response, and
per-hop callback invocation across a cross-origin redirect.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>