configuration (server): allow certificate selection to be dependent on the ALPN

[hannesm]

This is crucial for web servers using let's encrypt TLS-ALPN challenge (RFC 8737).

[hannesm]

another part of certificate selection should be based on signature algorithms -- i.e. when both EC and RSA certificates are available for the same alpn/hostname/..., accept that and select during the handshake the correct certificate (I suspect this step is already done). need to read up on the code to figure out whether this is actually an issue