Covers rejectUnknownSNI with and without a serverNames allow list, verifying allowed/unknown/empty SNI handshakes via openssl s_client.