zeek: implement JA4X (X.509 certificate fingerprinting)

[pigri]

Reproduce / Evidence

Any pcap containing TLS ≤1.2 server certificates works (TLS 1.3 encrypts the
Certificate message, so JA4X is only available for ≤1.2).

tshark — native JA4X (reference)

tshark -r <pcap> -2 -T fields -e ja4.ja4x \
  | sed 's/,.*//' | grep -E '_' | sort -u

zeek — this branch

zeek -C -r <pcap> packages
cat ssl.log | zeek-cut ja4x | grep -E '_' | sort -u

Evidence — leaf-cert JA4X is identical

diff \
  <(tshark -r <pcap> -2 -T fields -e ja4.ja4x | sed 's/,.*//' | grep -E '_' | sort -u) \
  <(zeek -C -r <pcap> packages && cat ssl.log | zeek-cut ja4x | grep -E '_' | sort -u)
# no output => identical