Add support for exporting TLS Keying Material or master secret

[sanjerai]

Motivation

RFC5705 defines and RFC8446 updates keying material exporters for TLS:

https://www.rfc-editor.org/rfc/rfc5705.html
https://www.rfc-editor.org/rfc/rfc8446#section-7.5

Many other TLS implementations already support it:

https://pkg.go.dev/crypto/tls#ConnectionState.ExportKeyingMaterial
https://docs.openssl.org/1.1.1/man3/SSL_export_keying_material
https://downloads.bouncycastle.org/java/docs/bctls-jdk18on-javadoc/org/bouncycastle/tls/TlsContext.html#exportKeyingMaterial-java.lang.String-byte:A-int-

5G mobile specs mandate the use of TLS session at app level for JWE:
https://www.tech-invite.com/3m33/toc/tinv-3gpp-33-501_zk.html#e-13-2-4-4-1

We have a spring-boot-starter-webflux code base communicating over TLS1.3 and HTTP2 and using reactor netty as base server. We have a use case to export TLS keying material or the master secret. We need this information to further derive keys for JWE tokens ciphering.

Desired solution

Option to export master secret after TLS handshake are complete.

Considered alternatives

Additional context

[violetagg]

@sanjerai There is already such functionality provided by Netty project https://netty.io/4.1/api/io/netty/handler/ssl/SslMasterKeyHandler.html
You can use Reactor Netty callbacks to extend your channel pipeline
https://projectreactor.io/docs/netty/release/reference/index.html#_lifecycle_callbacks_3