Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125,

for security reasons.  It now doesn't match multiple wildcards nor wildcards
inside IDN fragments.