CVE-2026-19553: ssl: SSLObject._create(), used by SSLContext.wrap_bio(),
now emits a DeprecationWarning when check_hostname is enabled and
server_hostname is None, and rejects server_hostname or session in
server mode with ValueError, as wrap_socket() does