Various custom extension fixes.

Force no SSL2 when custom extensions in use.
Don't clear extension state when cert is set.
Clear on renegotiate.
Merge remote-tracking branch 'openssl-github/master' into supplemental-data-api

Conflicts:
	ssl/s23_clnt.c
	ssl/ssl_rsa.c