Add a non-const tls_connection() getter to TlsHandshaker.

For context: https://github.com/envoyproxy/envoy/pull/42734#discussion_r2948352146

PiperOrigin-RevId: 885760611

quiche/quic/core/tls_client_handshaker.h

diff --git a/quiche/quic/core/tls_client_handshaker.h b/quiche/quic/core/tls_client_handshaker.h
index 07b0966..447f7b6 100644
--- a/quiche/quic/core/tls_client_handshaker.h
+++ b/quiche/quic/core/tls_client_handshaker.h
@@ -93,10 +93,12 @@
   using TlsHandshaker::ssl;
 
  protected:
-  const TlsConnection* tls_connection() const override {
-    return &tls_connection_;
+  const TlsConnection& tls_connection() const override {
+    return tls_connection_;
   }
 
+  TlsConnection& tls_connection() override { return tls_connection_; }
+
   void FinishHandshake() override;
   void OnEnterEarlyData() override;
   void FillNegotiatedParams();

quiche/quic/core/tls_handshaker.h

diff --git a/quiche/quic/core/tls_handshaker.h b/quiche/quic/core/tls_handshaker.h
index 605609a..ac7c6c2 100644
--- a/quiche/quic/core/tls_handshaker.h
+++ b/quiche/quic/core/tls_handshaker.h
@@ -122,9 +122,11 @@
   // Returns the PRF used by the cipher suite negotiated in the TLS handshake.
   const EVP_MD* Prf(const SSL_CIPHER* cipher);
 
-  virtual const TlsConnection* tls_connection() const = 0;
+  virtual const TlsConnection& tls_connection() const = 0;
 
-  SSL* ssl() const { return tls_connection()->ssl(); }
+  virtual TlsConnection& tls_connection() = 0;
+
+  SSL* ssl() const { return tls_connection().ssl(); }
 
   QuicCryptoStream* stream() { return stream_; }
   HandshakerDelegateInterface* handshaker_delegate() {

quiche/quic/core/tls_server_handshaker.h

diff --git a/quiche/quic/core/tls_server_handshaker.h b/quiche/quic/core/tls_server_handshaker.h
index cf36829..7267aaf 100644
--- a/quiche/quic/core/tls_server_handshaker.h
+++ b/quiche/quic/core/tls_server_handshaker.h
@@ -141,10 +141,12 @@
 
   virtual bool ValidateHostname(const std::string& hostname) const;
 
-  const TlsConnection* tls_connection() const override {
-    return &tls_connection_;
+  const TlsConnection& tls_connection() const override {
+    return tls_connection_;
   }
 
+  TlsConnection& tls_connection() override { return tls_connection_; }
+
   // Returns true if the handshake should continue. If false is returned, the
   // caller should fail the handshake.
   virtual bool ProcessAdditionalTransportParameters(