Fix encoding error in ECC groups using OID method. Reported by and
patch from fxdupont on github.
Remove duplicate definition of Serpent sboxes
Split TLS callbacks into a data callback and an alert callback.

In practice applications treated these two cases completely differently,
so there was no reason to combine them into a single callback.
Poll all randomness devices instead of breaking out early
Work around a strange bug where Clang won't find CCM_Mode::BS unless
it is non-static.
Use BS constant where possible
Avoid static const in GCM as well
Add more possible clock types
Simplify device opening, and avoid leaking a file descriptor if it was
too large to fit in an fd_set.

Read at least 128 bits even if the poll is asking for less.
Use override
Start updating release notes
merge of '5e53891d2c77f27a22d07ed26923745f9a5f3336'
     and 'a895552efd212665d83064e9517976ef63f41368'

Previously, AutoRNG was just a reference to the global rng, which can
cause a huge amount of lock contention in heavily multithreaded
code. Now each AutoRNG is its own uniquely seeded HMAC_RNG. The set of
entropy sources is shared rather than being per-RNG (so there is only
one open fd to /dev/random, etc). So reseeding is still a global lock,
but sharing the resources (open file descriptors, etc) across RNGs
seems worth the contention.

Remove Randpool, which was only used if HMAC_RNG was disabled at build.
At least 128 bits, not at most 128
Use a page size buffer as we are reading from a pipe
Make the process running entropy source much faster by running multiple commands
in parallel. On my laptop, a reseed using only process running takes .22 s wall
clock in trunk and .06 s with this change - and that's after increasing the
amount we read by 5 times (by reducing the entropy estimate per byte from .005
bits to 1/1024 bits).
Fix EGD settings. Some cleanup and renaming.
Don't actually deprecate AutoSeeded_RNG
Create RNG early so it is easy to check reseed times
Include a timestamp as part of the HMAC_RNG PRF inputs