Check postgresql ALPN value for direct SSL connections

[jawj]

Problem

Neon proxy accepts direct SSL Postgres-protocol connections with no ALPN protocol specified, whereas a real Postgres server does not.

Summary of changes

Make proxy reject direct SSL connections unless the ALPN protocol is postgresql. Traditional SSL connections (starting with an SSLRequest message) are unaffected.

Testing

openssl s_client endpoint.local.neon.build:4432  # should quit with EOF error (previously it didn't)
openssl s_client -alpn postgresql endpoint.local.neon.build:4432  # should hang awaiting data
PGSSLROOTCERT=./server.crt psql "postgresql://proxy:[email protected]:4432/postgres?sslmode=verify-full&sslnegotiation=direct"  # should continue to work

[github-actions]

9075 tests run: 8414 passed, 0 failed, 661 skipped (full report)

---

Flaky tests (3)

Postgres 17

• test_tx_abort_with_many_relations[v2]: release-arm64-without-lfc

Postgres 14

• test_tx_abort_with_many_relations[v2]: release-arm64-with-lfc
• test_tx_abort_with_many_relations[v1]: release-arm64-with-lfc

Code coverage* (full report)

• functions: 34.7% (8833 of 25437 functions)
• lines: 45.8% (71607 of 156398 lines)

* collected from Rust tests only

---

_{The comment gets automatically updated with the latest test results
bfb86b2 at 2025-07-30T14:27:58.353Z :recycle:}