Documented the SSL context used on connections without SNI

[VadimZhestikov]

Problem

On a connection without SNI, the entire SSL configuration of the default server
is used to establish the connection, client certificate verification included,
while the server block that processes the request is chosen afterwards from the
Host request header field. A client holding a certificate trusted by the
default server can therefore request resources from other servers listening on
the same address, including servers that verify client certificates against a
different certificate authority.

This is long-standing intended behaviour, and reports of it are configuration
issues rather than defects: the cross-server 421 restriction added in b720f650b
is about connection reuse across server names (RFC 6066), is deliberately gated
on SNI having been negotiated, and was never meant to isolate client-certificate
authorities between virtual servers.

It is, however, undocumented. The documentation currently explains only that a
non-SNI connection gets the default server's certificate, which does not lead
a reader to the client-certificate consequence. The same report has arrived
repeatedly over the years as a suspected vulnerability, and when this was last
discussed the conclusion was that the fix belongs in the documentation.

Solution

• configuring_https_servers.xml, in "Name-based HTTPS servers": generalise the
  existing paragraph about the default server's certificate to the whole SSL
  configuration, spell out the client-certificate consequence, cross-reference
  the "Virtual server selection" section of the Server names document from the
  sentence noting that the request server is chosen by Host, and note the two
  remedies -- ssl_reject_handshake in the default server with no client
  certificate verification there, and checking $ssl_client_s_dn /
  $ssl_client_i_dn in the server that processes the request, so that
  authorization is not inferred from authentication alone.
• ngx_http_ssl_module.xml, on ssl_verify_client: a short note pointing at
  that section, so the caveat is reachable from the reference documentation and
  not only from the tutorial.
• Russian translation (xml/ru/...) added in parallel, using "CA" for the
  certificate-authority wording to match ssl_client_certificate.

No behaviour change; documentation only.

Testing

• xmllint --noout --valid against dtd/ passes for all four files
  (English and Russian).
• Both pages build with the project's makefile, and the rendered output was
  checked: the new links resolve and their target anchors are present in the
  built pages.

[VadimZhestikov]

Thanks, addressed all points:

• Dropped "and not just its certificate" -- the note now reads generically.
• Reworded to "The server configuration that processes the request may be switched afterwards", since it can be switched by SNI, URI, or Host (not only Host).
• Reworded the mitigation to "connections without SNI should be limited by ssl_reject_handshake in the default server".
• Dropped "and do not verify client certificates there" (it acts earlier, at ClientHello). Added your side case: a request can still reach the default server on the application level when a non-default server is selected by SNI but the Host does not match it, so the default server should also reject such requests, e.g. with return.
• Removed the note from ssl_verify_client in ngx_http_ssl_module.xml.

Russian translation updated to match.