Add functions to httparchive.go to restrict certificate SANs

[arthesh]

WPR requests get served from a single server on playback which leads to connection reuse that would otherwise not be possible in production. e.g.The SSL cert for www.msn.com is valid for *.msn.com. This also matches c.msn.com & otf.msn.com. When testing with WPR – requests to these domains can all be served on one TCP connection.
In production , this would never occur as these domains are actually different servers (having different IP addresses).

Why is this a problem ?
• This results in fewer connections and alters the behavior of the waterfall . In cases where the additional connection set-up is on the critical path for a primary metric it could result in faster web perf metrics with WPR.

What does the change do –
• The functions for transforming certificates records the IP addresses of the actual servers when it makes a connection to them.
• Then we edit their Subject Alternative Names fields so that only those requests which are to the same destination IP can be served on the same connection.

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.