streams: both `finish` and `close` should unpipe

Otherwise sockets that are 'finish'ed won't be unpiped and `writing to
ended stream` error will arise.

This might sound unrealistic, but it happens in net.js. When
`socket.allowHalfOpen === false`, EOF will cause `.destroySoon()` call which
ends the writable side of net.Socket.
tls: port CryptoStream to streams2