Wait for handshakes before replacing a server's certificates

update_certs_pem() replaced the certificate, key and client CAs inside
the TLS context while handshakes on other threads were still reading
them, and only the creation of a session was serialized with it. A
server rotating its certificates under load could crash.

Count the handshakes in progress, make an update wait until there are
none, and hold off new handshakes while an update is pending so that a
steady stream of them cannot keep it waiting. The wait is bounded by
the handshake timeout.

docs-src/pages/en/cookbook/t03-ssl-server.md

@@ -60,7 +60,7 @@ Before a certificate expires, you may want to swap it out without restarting the
 svr.update_certs_pem(new_cert_pem, new_key_pem);
 ```
 
-Existing connections keep using the old cert; new connections use the new one.
+Existing connections keep using the old cert; new connections use the new one. It waits for handshakes in progress to finish, at most the read timeout, and new connections wait until it returns.
 
 ## Generating a test certificate
 

docs-src/pages/ja/cookbook/t03-ssl-server.md

@@ -60,7 +60,7 @@ httplib::SSLServer svr(pem);
 svr.update_certs_pem(new_cert_pem, new_key_pem);
 ```
 
-既存の接続はそのまま、これから確立する接続は新しい証明書で動きます。
+既存の接続はそのまま、これから確立する接続は新しい証明書で動きます。差し替えは進行中のハンドシェイクが終わってから行われ（長くても読み取りタイムアウトまで）、その間に来た接続は差し替えが終わるまで待ちます。
 
 ## 証明書の準備