Pass the session handle to wolfSSL verify callbacks

The wolfSSL verify callback set VerifyContext::session to the raw WOLFSSL
pointer, while every other tls:: function takes the WolfSSLSession that
wraps it, so passing ctx.session on from a verifier read the wrong type.
Point each WOLFSSL back to its WolfSSLSession and hand that out instead,
as the OpenSSL and Mbed TLS backends already do with their own handles.

test/test.cc

@@ -15706,6 +15706,46 @@ TEST(VerifyCallbackTest, VerifierStaysWithItsClient) {
   EXPECT_GT(accepting_calls, 0);
 }
 
+// VerifyContext::session is the same handle the other tls:: functions take.
+TEST(VerifyCallbackTest, SessionMatchesSessionVerifier) {
+  using namespace httplib::tls;
+
+  SSLServer svr(SERVER_CERT_FILE, SERVER_PRIVATE_KEY_FILE);
+  ASSERT_TRUE(svr.is_valid());
+
+  svr.Get("/test", [](const Request &, Response &res) {
+    res.set_content("ok", "text/plain");
+  });
+
+  auto port = svr.bind_to_any_port(HOST);
+  thread t([&]() { svr.listen_after_bind(); });
+  auto se = detail::scope_exit([&] {
+    svr.stop();
+    t.join();
+  });
+  svr.wait_until_ready();
+
+  SSLClient cli(HOST, port);
+  cli.enable_server_certificate_verification(false);
+
+  session_t verifier_session = nullptr;
+  cli.set_server_certificate_verifier([&](const VerifyContext &ctx) {
+    verifier_session = ctx.session;
+    return true;
+  });
+
+  session_t session_verifier_session = nullptr;
+  cli.set_session_verifier([&](session_t session) {
+    session_verifier_session = session;
+    return SSLVerifierResponse::NoDecisionMade;
+  });
+
+  auto res = cli.Get("/test");
+  ASSERT_TRUE(res) << "Error: " << to_string(res.error());
+  EXPECT_NE(nullptr, verifier_session);
+  EXPECT_EQ(session_verifier_session, verifier_session);
+}
+
 TEST(TlsVerifyErrorTest, GetVerifyErrorString) {
   using httplib::tls::TlsError;