Add OpenVPN to CI

[smittals2]

Description of changes:

1. Added patch for TLS1_PRF to use alternative codepath in OpenVPN (for versions <= 2.6.x)
2. integration script and workflow for Github CI

Call-outs:

• We anchor to tip of the minor version 2.6.x. We can not support OpenVPN versions > 2.6 as tip of main has removed the alternate codepath for TLS1_PRF that we currently rely on. This change should be pulled into the next minor version of OpenVPN and will break AWS-LC compatibility.
• Management interface is disabled when building openVPN, this will be changed in a later PR once we add in support.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.35%. Comparing base (98ccf4a) to head (a493a20).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1705      +/-   ##
==========================================
- Coverage   78.35%   78.35%   -0.01%     
==========================================
  Files         573      573              
  Lines       96065    96065              
  Branches    13764    13764              
==========================================
- Hits        75270    75268       -2     
- Misses      20195    20196       +1     
- Partials      600      601       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[WillChilds-Klein]

not a blocker, but why is this change needed? looking at the source, the cert_names stack doesn't appear to be modified between these assignments of cnum.

[smittals2]

Once SSL_CTX_set_client_CA_list is called (line 52), in OpenSSL the passed in cert_names stack remains untouched but AWS-LC resets it. So later when sk_X509_NAME_num is called (previously line 59), we get a 0 length in AWS-LC which causes an error below when cnum != added (line 60). Therefore, we obtain the length of the stack before calling SSL_CTX_set_client_CA_list. This patch doesn't break behavior for OpenSSL either.