Cleanup TLS parser

Overhaul tls.c, should not alter behavior other than returning -1 on
an incomplete TLS record early rather than when when about to run off
the end of the buffer.