EHLO or CAPABILITY handshake before sending STARTTLS

Submitted by: Goetz Babin-Ebell <goetz@shomitefo.de>

PR: 1152
Submitted by: Mike Frysinger <vapier@gentoo.org>

PR: 1277
Submitted by: Mike Frysinger <vapier@gentoo.org>

PR: 1459
Submitted by: tnitschke@innominate.com
Reviewed by: steve@openssl.org

ciphersuite string such as "DEFAULT:RSA" cannot enable
authentication-only ciphersuites.

Submitted by: Victor Duchovni

- add a workaround provided by Victor Duchovni so that 128- and
  256-bit variants of otherwise identical ciphersuites are treated
  correctly;

- also, correctly skip invalid parts of ciphersuite description strings.

Submitted by: Victor Duchovni, Bodo Moeller

PR: 1490

Submitted by Kees Cook <kees@outflux.net>

- move zlib_stateful_ex_idx initialization to COMP_zlib()

PR: 1468

PR: 1467
Submitted by: Andrei Pelinescu-Onciul <andrei@iptel.org>

PR: 1476

free of those objects

PR: 1461

PR: 1466

PR: 1462
Submitted by: Charles Hardin <chardin@2wire.com>

PR: 1441

PR: 1354, 1355, 1398