Don't send session tickets when client authentication is being used

[kazuho]

Two issues:

• the ticket is never used, because resumption and client authentication are mutually exclusive features in picotls
• the handshake transcript used for generating the ticket is in correct, because we send the ticket along with ServerFinished under the assumption that the only yet-to-be-seen messages are EOED and CF

[huitema]

Of course, the best solution would be to actually support resumption with client auth, and carry the client-id in the ticket somehow. That way we could have client auth and zero-rtt...

[kazuho]

I'm happy to look at a PR that actually implements that; IMO the basic approach would be to let the have a blob identifying the client in ptls_t. Applications would set the blob in the verify_sign callback. Picotls sends it in NST and also decodes it from a session ticket.