Make sure ssl3_setup_buffers() does not return upon error with a freed
pqueue still chained, by inserting it into the list only after all possible
failure conditions have been avoided.

Reported and fix proposed by David Ramos; ok beck@
In ssl3_send_certificate_request(), when adding the extra payload if
NETSCAPE_HANG_BUG is defined, make sure we BUF_MEM_grow() the buffer to
accomodate for the payload size.

Issue reported by David Ramos; ok beck@
In dtls1_reassemble_fragment() and dtls1_process_out_of_seq_message(), in case
of error, make sure we do not free pitem which is still linked into the
pqueue.
In the same vain, only free `frag' if we allocated it in this function.

Help and ok beck@
In OCSP_sendreq_bio(), cope with OCSP_sendreq_new() returning NULL.

ok jsing@
Plug memory leaks upon error in OCSP_url_svcloc_new().

ok jsing@
Group and sort includes.

Currently "apps.h" needs to be included before any of the openssl headers
and there are several cases where the code depends on headers that are
included by something included by apps.h...

More untangling saved for later on.
Remove unused include.
W_OK comes via unistd.h - nuke several #ifndef W_OK that attempt to handle
missing defines.
Out of all the openssl apps, just one of them has code to mess around with
electric fence externs. Nuke from orbit.

ok miod@