Guard SSL_set_reject_unusable_ech_config with BORINGSSL_API_VERSION >= 43.

`SSL_set_reject_unusable_ech_config` was introduced in BoringSSL while
`BORINGSSL_API_VERSION` was 42. OSS QUICHE CI builds against an older
pinned version of BoringSSL that is also on `BORINGSSL_API_VERSION == 42`,
which caused the build to break.

Guarding the usage with `#if BORINGSSL_API_VERSION >= 43` ensures OSS QUICHE
builds succeed until BoringSSL bumps `BORINGSSL_API_VERSION` to 43 and rolls.

Protected by FLAGS_quic_reloadable_flag_quic_reject_unusable_ech_config.

PiperOrigin-RevId: 963494594

quiche/quic/core/tls_client_handshaker.cc

diff --git a/quiche/quic/core/tls_client_handshaker.cc b/quiche/quic/core/tls_client_handshaker.cc
index e4c53f6..c1e4c33 100644
--- a/quiche/quic/core/tls_client_handshaker.cc
+++ b/quiche/quic/core/tls_client_handshaker.cc
@@ -162,11 +162,13 @@
 
   SSL_set_enable_ech_grease(ssl(),
                             tls_connection_.ssl_config().ech_grease_enabled);
+#if BORINGSSL_API_VERSION >= 43
   if (GetQuicReloadableFlag(quic_reject_unusable_ech_config)) {
     QUIC_RELOADABLE_FLAG_COUNT(quic_reject_unusable_ech_config);
     SSL_set_reject_unusable_ech_config(
         ssl(), tls_connection_.ssl_config().reject_unusable_ech_config);
   }
+#endif
   if (!tls_connection_.ssl_config().ech_config_list.empty() &&
       !SSL_set1_ech_config_list(
           ssl(),

quiche/quic/core/tls_client_handshaker_test.cc

diff --git a/quiche/quic/core/tls_client_handshaker_test.cc b/quiche/quic/core/tls_client_handshaker_test.cc
index a9b11f2..484951e 100644
--- a/quiche/quic/core/tls_client_handshaker_test.cc
+++ b/quiche/quic/core/tls_client_handshaker_test.cc
@@ -942,6 +942,7 @@
   stream()->CryptoConnect();
 }
 
+#if BORINGSSL_API_VERSION >= 43
 TEST_P(TlsClientHandshakerTest, ECHRejectUnusableConfigFlagEnabled) {
   // When reject_unusable_ech_config is enabled, and no usable ECHConfig is
   // available, the client should fail before sending a ClientHello.
@@ -991,6 +992,7 @@
   EXPECT_TRUE(stream()->one_rtt_keys_available());
   EXPECT_TRUE(stream()->crypto_negotiated_params().encrypted_client_hello);
 }
+#endif  // BORINGSSL_API_VERSION >= 43
 
 TEST_P(TlsClientHandshakerTest, ECHWrongKeys) {
   ssl_config_.emplace();