crypto: improve cipher/decipher error messages

Throw the OpenSSL error string instead of the rather less informative
error message "fail".
stream: Empty strings/buffers do not signal EOF any longer
stream: read(0) should not always trigger _read(n,cb)

This is causing the CryptoStreams to get into an awful state when
there is a tight loop calling connection.write(chunk) waiting for
a false return.

Because CryptoStreams use read(0) to cycle data, this was causing
the encrypted side to pull way too much data in from the cleartext
side, since the read(0) would make it always call _read.

The unfortunate side effect, fixed in the next patch, is that
CryptoStreams don't automatically cycle when the Socket drains.
tls: Cycle data when underlying socket drains