aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

An attacker who can influence the `server_hostname` parameter on subsequent requests to the same domain can bypass the TLS SNI check. When keep-alive is enabled, the connection pool reuses an existing TLS connection that was authenticated for a different `server_hostname`, so the second request succeeds even though the server certificate does not match the requested hostname. The attacker must be able to make multiple requests through the same `ClientSession` with different `server_hostname` values.

The vulnerability is in `aiohttp/client_reqrep.py` where `ConnectionKey` (a `NamedTuple`) did not include the per-request `server_hostname` field. This caused the connection pool to treat two requests with different `server_hostname` values as having the same connection key, allowing a TLS connection established for one hostname to be reused for a different hostname.

The patch adds a `server_hostname` field to the `ConnectionKey` named tuple in `aiohttp/client_reqrep.py` and includes `self.server_hostname` when constructing the connection key. This ensures that requests with different `server_hostname` values produce distinct connection keys, preventing the connection pool from reusing a TLS connection that was established for a different hostname. The new unit tests verify that connection keys differ when `server_hostname` differs and that a pooled connection is not reused for a mismatched hostname.