nss: do not abort on connection failure

... due to calling SSL_VersionRangeGet() with NULL file descriptor

reported-by: upstream tests 305 and 404
nss: make the fallback to SSLv3 work again

This feature was unintentionally disabled by commit ff92fcfb.
tool: call PR_Cleanup() on exit if NSPR is used

This prevents valgrind from reporting possibly lost memory that NSPR
uses for file descriptor cache and other globally allocated internal
data structures.