previous cbc128.c commit].

(cherry picked from commit b69437e1)

(cherry picked from commit 4df2280b)

(and pending AVX2 changes).
(cherry picked from commit 504bbcf3)

(cherry picked from commit 988d11b6)

Note that it initially applies to 1.0.2, and not to HEAD. This is
in order to allow development with existing libunbound installations
that are dependent on OpenSSL 1.0.x. More details in RT.

RT: 3003

Reencode certificates in X509_sign_ctx as well as X509_sign.

This was causing a problem in the x509 application when it modified an
existing certificate.
(cherry picked from commit c6d8adb8)