Fix CERTIFICATE STATUS processing when using non-blocking I/O

_gnutls_recv_server_certificate_status() must wait for the first full
packet before setting priv->expect_cstatus = 0, or else CERTIFCATE
STATUS packets won't be processed in subsequent calls at all, leaving
them in the buffer and therefore causing later connection aborts.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
doc update
gnutls-cli-debug should accept TLS 1.2-only servers

Without this patch, a TLS 1.2-only server will not be properly
investigated by gnutls-cli-debug.

e.g. a server like:

  gnutls-serv --x509keyfile=server/secret.key --x509certfile=server/x509.pem --priority 'NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2'

gets this failed analysis:

0 dkg@alice:~$ gnutls-cli-debug --port 5556 localhostrt 5556 localhost
Resolving 'localhost'...
Connecting to '::1:5556'...
Checking for SSL 3.0 support... no
Checking whether %COMPAT is required... yes
Checking for TLS 1.0 support... no
Checking for TLS 1.1 support... no
Checking fallback from TLS 1.1 to... failed
Checking for TLS 1.2 support... yes
Checking whether we need to disable TLS 1.2... N/A
Checking whether we need to disable TLS 1.1... no

Server does not support any of SSL 3.0, TLS 1.0 and TLS 1.1
0 dkg@alice:~$

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
gnutls_pkcs11_crt_is_known will not be exported in this version. It is replaced by the internal _gnutls_pkcs11_crt_is_known().