SSL.Session: Default to creation with empty id.

This is useful for client-side SSL, where there typically isn't
a useful sessionid at start.
SSL.ClientConnection: Use a plain Session if none is provided.

This avoids extraneous caching of client side sessions in
a cache where they will never be looked up.
Testsuite: Test SSL session resumption.
Image.PNG: handle extra IDAT data more gracefully