The enhancement implements the new RFC 9846-style support group selection on the server side (first mutual group matters) and change the supported-groups format. Specifically:
1. `SSLParameters.setNamedGroups` and the `jdk.tls.namedGroups` system property now recognize a *-prefix on a group name. 2. The prefix does not change the supported_groups extension. 3. On a TLS 1.3 client, usable starred groups determine the initial key_share entries. If no usable starred group remains, JSSE falls back to its existing automatic key-share selection. 4. SunJSSE’s default parameters contains 2 starred groups, which can be observed by `getNamedGroups`. 5. The server ignores the marker in its own configuration. 6. Server group selection now follows RFC 9846: choose the first mutually supported group according to the client’s supported_groups order, then sends ServerHello if its key share is present or HelloRetryRequest if not. No new API or system property defined for the new format. The existing methods and system property are already called a lot by both JSSE itself and an application. The default value of the system property is empty which gives each provider the chance to define it itself. --------- - [x] I confirm that I make this contribution in accordance with the [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). ------------- Commit messages: - a test - the change Changes: https://git.openjdk.org/jdk/pull/32586/files Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=32586&range=00 Issue: https://bugs.openjdk.org/browse/JDK-8388484 Stats: 726 lines in 10 files changed: 643 ins; 10 del; 73 mod Patch: https://git.openjdk.org/jdk/pull/32586.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/32586/head:pull/32586 PR: https://git.openjdk.org/jdk/pull/32586
