tls: don't .push() incoming data when `ondata` is set

Otherwise the data ends up "on the wire" twice, and switching between
consuming the stream using `ondata` vs. `read()` would yield duplicate
data, which was bad.