tls: handle ZERO_RETURN

ZERO_RETURN is generally returned when other side has closed (with
CLOSE_NOTIFY) connection. In such cases, error should be emitted.

/cc @bnoordhuis