GnuTLS CURLINFO_TLS_SESSION / CURLINFO_TLS_SSL_PTR type confusion

## Summary: `curl_easy_getinfo` for `CURLINFO_TLS_SESSION` and `CURLINFO_TLS_SSL_PTR` incorrectly return `CURLSSLBACKEND_OPENSSL` in `struct curl_tlssessioninfo` `backend` field for GnuTLS. ``` struct curl_tlssessioninfo { curl_sslbackend backend; void *internals; }; ``` The bug is at https://github.com/curl/curl/blob/2db8ae480fdcae7f005bf847fbbf837821c8184c/lib/vquic/vquic-tls.c#L211 ``` #elif defined(USE_GNUTLS) (void)give_ssl_ctx; /* gnutls always returns its session */ info->backend = CURLSSLBACKEND_OPENSSL; info->internals = ctx->gtls.session; return TRUE; ``` If the caller interprets the `backend` and makes dynamic decision on the value it will parse `gnutls_session_t` as `SSL_CTX ` / `SSL`, leading to type confusion. Example of an affected code can be found from: https://github.com/curl/curl/blob/7c23e88d17e0939b4e01c8d05f430e167e148f4b/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.md?plain=1#L144 What actually happens when the incorrect pointer is passed to OpenSSL functions is unknown and depends on the specific application code and what functions it will call. At minimum a crash is likely, but other impacts can't easily be ruled out, especially considering wide platform and version support in libcurl. Mitigating factors: For this issue to become an issue, the application must be linked against *both* GnuTLS abd OpenSSL . This seems quite unlikely - but isn't entirely impossible. Either way, as such the impact of this vulnerability is limited. I cannot easily point out any affected applications. ## Affected version 8.15.0 ## Steps To Reproduce: 1. Have app built against both GnuTLS and OpenSSL. 2. Have the app use `curl_easy_getinfo` with either `CURLINFO_TLS_SESSION` or `CURLINFO_TLS_SSL_PTR`. 3. Have code calling OpenSSL functions when `CURLSSLBACKEND_OPENSSL == info->backend`, ## Supporting Material/References: * This bug appears to have been added by commit https://github.com/curl/curl/commit/2db8ae480fdcae7f005bf847fbbf837821c8184c * This report is AI free for your pleasure. Stop the slop! ## Impact ## Summary: Crash, potential unknown other impacts depending on the application code.