Whitelist handshake_failure alert for early CCS

Some clients reply with handshake_failure rather than protocol_version when the server chooses a protocol version they don't like.