Never run crypto_early_init() more than once

Previously we had set up all the infrastructure to avoid calling it
after the first time, but didn't actually use it.
Stop leaking 'sig' at each call of router_append_dirobj_signature()

The refactoring in commit cb75519b (tor 0.2.4.13-alpha) introduced
this leak.
changes file for bug 11275
Merge remote-tracking branch 'public/bug11275_024'
Merge remote-tracking branch 'arma/bug11276'
Changes file for bug 11276.

The crypto_early_init() function could only be called at most twice,
and both of those were during startup.  AFAICT leaking the first set
of locks was the only non-idempotent thing.