cstp: Rework DTLS master secret (re)generation

Improve handling of the following cases:

 - Server-specified "rekey method none".  In this case, openconnect should
   generate one DTLS master secret on initial connection, and reuse it
   for the lifetime of the VPN session.

 - DTLS key changes.  The DTLS connection needs to be torn down any time
   a new master secret is sent to the server, or else the client and
   server will lose DTLS connectivity (possibly for extended periods of
   time).

   We will assume for now that the server-provided DTLS session ID only
   changes if we send a new DTLS master secret, as that is the behavior
   seen on current ASA firmware releases.

 - CSTP reconnections.  dtls_times.last_rekey should only be updated when
   the key actually gets overwritten by new random data, not every time
   we see an "X-DTLS-Session-ID:" header (which happens on every CSTP
   reconnect).

Note that there is one case in which our master DTLS secret will be
rejected: if it is all zeroes.  I have confirmed that other trivial keys
(00000....01, fffff....) are OK.  So we probably do not have to worry too
much about DTLS failing permanently if we send an unacceptable key in the
"rekey method none" case.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
mainloop: Use consistent logic for rekey timeout check

ka_stalled_action() and keepalive_action() should both use the same test.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
mainloop: Simplify the keepalive functions

Moving the "compare values + update timeout" logic into a helper function
lets us delete several duplicated checks and temporary variables.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
dtls: Fix link error on !HAVE_DTLS builds

Several internal library functions call dtls_close() to clean up, so just
make it a stub function if this is a non-DTLS build.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>