boot(9): Undo curproc-overriding hacks

Some (not all) boot(9) implementations have ancient hacks which overrides if
(curproc == NULL).  This was probably made in a hope to forcibly proceed
various clean-shutdown related code, including VFS shutdown.  Let's clarify
that clean-shutdown needs process context; it is impossible to cleanly shutdown
VFS from within e.g. a panic in SPL_HIGH.

OK kettenis@
Limit HTTP header length to about 8K (based on the default of 4-8K in
common web servers).  Add a related regress test.

OK benno@
Add OpenBSD RCS id.
As reported by David Ramos, most consumer of ssl_get_message() perform late
bounds check, after reading the 2-, 3- or 4-byte size of the next chunk to
process. But the size fields themselves are not checked for being entirely
contained in the buffer.

Since reading past your bounds is bad practice, and may not possible if you
are using a secure memory allocator, we need to add the necessary bounds check,
at the expense of some readability.

As a bonus, a wrong size GOST session key will now trigger an error instead of
a printf to stderr and it being handled as if it had the correct size.

Creating this diff made my eyes bleed (in the real sense); reviewing it
made guenther@'s and beck@'s eyes bleed too (in the literal sense).

ok guenther@ beck@
optimize a FALLTHROUGH
implicit ok reyk
Put a license file into the test directories with multiple argument
files.  We do not want to put a license header into each subtest.
suggested by reyk@
use CC when running configure
matches the behaviour of the other Makefile.bsd-wrapper files
ok miod@