Fix StartTLS as it's not working.

*) Remove direct writes to the connection.

*) StartTLS can be done at any time, not just at start of the connection (see
RFC 4513 3.1.1) with the execptions the TLS is not just already estabilished,
no SASL multistage negotiation in progress and no outstanding responses.
For this reason this patch adds a counter on outstanding requests and checks
them before doing startTLS.

*) Reader should be stopped after the startTLS response or it will block on
ber.ReadPacket and error out trying to decode the tls handshake data as ber
packets. After a successfull handshake it will be restarted with the new tls
connection.
Add a searchStartTLS example that will firstly do the search without tls and
then issue a StartTLS and redo the same search.