evp/e_aes_cbc_sha[1|256].c: fix -DPEDANTIC build.
Accept CCS after sending finished.

Allow CCS after finished has been sent by client: at this point
keys have been correctly set up so it is OK to accept CCS from
server. Without this renegotiation can sometimes fail.

PR#3400
Enforce _X509_CHECK_FLAG_DOT_SUBDOMAINS internal-only