fix a test that relied on the current input port as not-ready
make non-determinstic test less likely to fail

A test tries to fill a TCP output stream so that it's no longer ready
for writing. There's no real guarantee that it's possible to setup up
and detect that situation, and a failure or two is not too suspicious,
but it really should be possible to fill the buffer. Trying 5 times
should make failure of the test especially unlikely in practice.
openssl: add `supported-{client,server}-protocols`

Use the new functions to avoid running a test that requires 'tls12
to succeed.
fix documented contract for `guard-evt` et al.

The `(or/c evt? any/c)` result contract is, of course, equivalent to
`any/c`, but the verbose variant hopefully helps explain that `evt?`
is really expected.

Yes, it would be better if the result contract actually was `evt?`
(and I implemented `replace-evt` that way before re-reading the
`guard-evt` docs).
pkg test harness: fix race condition in I/O handling