Bump cheroot from 8.5.2 to 8.6.0 (#1603)

* Bump cheroot from 8.5.2 to 8.6.0

Bumps [cheroot](https://github.com/cherrypy/cheroot) from 8.5.2 to 8.6.0.
- [Release notes](https://github.com/cherrypy/cheroot/releases)
- [Changelog](https://github.com/cherrypy/cheroot/blob/master/CHANGES.rst)
- [Commits](https://github.com/cherrypy/cheroot/compare/v8.5.2...v8.6.0)

---
updated-dependencies:
- dependency-name: cheroot
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update cheroot==8.6.0

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JonnyWong16 <9099342+JonnyWong16@users.noreply.github.com>

lib/cheroot/test/test_ssl.py

@@ -22,7 +22,7 @@ import six
 import trustme
 
 from .._compat import bton, ntob, ntou
-from .._compat import IS_ABOVE_OPENSSL10, IS_PYPY
+from .._compat import IS_ABOVE_OPENSSL10, IS_CI, IS_PYPY
 from .._compat import IS_LINUX, IS_MACOS, IS_WINDOWS
 from ..server import HTTPServer, get_ssl_adapter_class
 from ..testing import (
@@ -52,6 +52,7 @@ IS_PYOPENSSL_SSL_VERSION_1_0 = (
 PY27 = sys.version_info[:2] == (2, 7)
 PY34 = sys.version_info[:2] == (3, 4)
 PY3 = not six.PY2
+PY310_PLUS = sys.version_info[:2] >= (3, 10)
 
 
 _stdlib_to_openssl_verify = {
@@ -149,8 +150,8 @@ def tls_ca_certificate_pem_path(ca):
 @pytest.fixture
 def tls_certificate(ca):
     """Provide a leaf certificate via fixture."""
-    interface, host, port = _get_conn_data(ANY_INTERFACE_IPV4)
-    return ca.issue_server_cert(ntou(interface))
+    interface, _host, _port = _get_conn_data(ANY_INTERFACE_IPV4)
+    return ca.issue_cert(ntou(interface))
 
 
 @pytest.fixture
@@ -270,6 +271,11 @@ def test_ssl_adapters(
         ssl.CERT_REQUIRED,  # server should validate if client cert CA is OK
     ),
 )
+@pytest.mark.xfail(
+    IS_PYPY and IS_CI,
+    reason='Fails under PyPy in CI for unknown reason',
+    strict=False,
+)
 def test_tls_client_auth(  # noqa: C901  # FIXME
     # FIXME: remove twisted logic, separate tests
     mocker,
@@ -294,8 +300,7 @@ def test_tls_client_auth(  # noqa: C901  # FIXME
         'idna.core.ulabel',
         return_value=ntob(tls_client_identity),
     ):
-        client_cert = client_cert_root_ca.issue_server_cert(
-            # FIXME: change to issue_cert once new trustme is out
+        client_cert = client_cert_root_ca.issue_cert(
             ntou(tls_client_identity),
         )
         del client_cert_root_ca
@@ -419,6 +424,10 @@ def test_tls_client_auth(  # noqa: C901  # FIXME
                 'ConnectionResetError(10054, '
                 "'An existing connection was forcibly closed "
                 "by the remote host', None, 10054, None))",
+                "('Connection aborted.', "
+                'error(10054, '
+                "'An existing connection was forcibly closed "
+                "by the remote host'))",
             ) if IS_WINDOWS else (
                 "('Connection aborted.', "
                 'OSError("(104, \'ECONNRESET\')"))',
@@ -437,13 +446,35 @@ def test_tls_client_auth(  # noqa: C901  # FIXME
                 "('Connection aborted.', "
                 "BrokenPipeError(32, 'Broken pipe'))",
             )
+
+        if PY310_PLUS:
+            # FIXME: Figure out what's happening and correct the problem
+            expected_substrings += (
+                'SSLError(SSLEOFError(8, '
+                "'EOF occurred in violation of protocol (_ssl.c:",
+            )
+        if IS_GITHUB_ACTIONS_WORKFLOW and IS_WINDOWS and PY310_PLUS:
+            expected_substrings += (
+                "('Connection aborted.', "
+                'RemoteDisconnected('
+                "'Remote end closed connection without response'))",
+            )
+
         assert any(e in err_text for e in expected_substrings)
 
 
 @pytest.mark.parametrize(  # noqa: C901  # FIXME
     'adapter_type',
     (
-        'builtin',
+        pytest.param(
+            'builtin',
+            marks=pytest.mark.xfail(
+                IS_GITHUB_ACTIONS_WORKFLOW and IS_MACOS and PY310_PLUS,
+                reason='Unclosed TLS resource warnings happen on macOS '
+                'under Python 3.10',
+                strict=False,
+            ),
+        ),
         'pyopenssl',
     ),
 )
@@ -602,18 +633,19 @@ def test_https_over_http_error(http_server, ip_addr):
     assert expected_substring in ssl_err.value.args[-1]
 
 
+http_over_https_error_builtin_marks = []
+if IS_WINDOWS and six.PY2:
+    http_over_https_error_builtin_marks.append(
+        pytest.mark.flaky(reruns=5, reruns_delay=2),
+    )
+
+
 @pytest.mark.parametrize(
     'adapter_type',
     (
         pytest.param(
             'builtin',
-            marks=pytest.mark.xfail(
-                IS_WINDOWS and six.PY2,
-                raises=requests.exceptions.ConnectionError,
-                reason='Stdlib `ssl` module behaves weirdly '
-                'on Windows under Python 2',
-                strict=False,
-            ),
+            marks=http_over_https_error_builtin_marks,
         ),
         'pyopenssl',
     ),
@@ -654,7 +686,7 @@ def test_http_over_https_error(
     interface, _host, port = _get_conn_data(ip_addr)
     tlshttpserver = tls_http_server((interface, port), tls_adapter)
 
-    interface, host, port = _get_conn_data(
+    interface, _host, port = _get_conn_data(
         tlshttpserver.bind_addr,
     )