Enforce that Session is only re-used with the Context it came from

[alex]

SSL_set_session requires that the session originate from a compatible SSL_CTX, but neither pyOpenSSL nor OpenSSL verifies this — rust-openssl marks SslRef::set_session as unsafe fn for precisely this reason.

This makes the contract checkable instead of deprecating the API:

• Session now pins the Context of the Connection it was obtained from (Connection.get_session sets it).
• Connection.set_session raises ValueError if the session's pinned Context is not the same object as the connection's current Context. Identity is checked against the current context, so it remains correct across set_context.

This is stricter than the C API (it requires the same Context object, not merely a "compatible" one), but since Context wraps its SSL_CTX 1:1, object identity is the only check that's trivially sound.

Test changes:

• test_client_set_session previously created a fresh client Context per connection — exactly the unverifiable pattern this change forbids. It now reuses one client Context across both connections, making it a real resumption test.
• test_set_session_wrong_method became test_set_session_wrong_context: the mismatch is now rejected eagerly with ValueError rather than provoking an Error deep in OpenSSL during a second handshake.

Changelog entry added under 26.3.0 backward-incompatible changes.

https://claude.ai/code/session_01UewVp2VriZJPGm96VFVZ8k

---

Generated by Claude Code