Add checking for session ticket key rotation.

This checks that hosts negotiating DH cipher suites do ticket key rotation correctly: https://www.imperialviolet.org/2013/06/27/botchingpfs.html.