Fix several bounds checks in ssl_add_clienthello_tlsext() and
ssl_add_serverhello_tlsext(), and convert all of them to the same idiom, for
easier review.

Math is hard, let's go webshopping.

Help and ok guenther@