Fix strict client chain check with TLS-1.3
Fix strict client chain check with TLS-1.3

When TLS-1.3 is used and the server does not send any CA names
the ca_dn will be NULL. sk_X509_NAME_num() returns -1 on null
argument.

Reviewed-by: Todd Short <0267f0ecbdb3e99cdfd94eb139bf30919fa04d2f@me.com>
Reviewed-by: Matt Caswell <1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17986)

openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl