add STARTTLS support to go-xmpp

This commit adds support for STARTTLS, as described in [RFC-3920](http://xmpp.org/rfcs/rfc3920.html#tls) and implemented by the [Slack](http://slack.com) chat server.  I have introduced one minor incompatibility in the name of safety, which could be reverted if @mattn prefers:  go-xmpp will refuse to authenticate over TCP connections if STARTTLS did not happen.

This ensures that MITMs cannot gather plaintext authentication information or act as a proxy to abuse MD5 digest authentication.  Previously, go-xmpp permitted this because NoTLS more explicitly declared a conscious decision to disregard the need for an encrypted connection.