tls: port CryptoStream to streams2

Please review very carefully, I've put a couple of obscure bugs inside this pull request to annoy you guys later on.

/cc @isaacs @bnoordhuis (and probably @pquerna)