Check for calloc() failure to prevent segmentation fault in onion_new()

Previously in the function onion_new(), the onion* object would be allocated via calloc() then immediately put to use (e.g. o->flags=...). If calloc() fails (e.g. when out of memory), this will result in a segmentation fault. This commit checks if the allocation succeeded and, if it did not, returns NULL.