use the term "custom DHE group" consistently
limit CertificateRequest only to position in the handshake

I don't think the CertificateRequest needs to be limited to
authenticated servers, or to certain ciphersuites.

i note that RFC 5246 (TLS 1.2) does seem to suggest these same
limitations, but it's not clear to me why they exist.  If we're going
for a simpler state machine for TLS 1.3, i see no reason to keep these
limitations.
clean up language

there is no "first handshake" any more, and the ChangeCipherSpec
message is being sent much earlier here.  The constraints replaced
here don't make sense in the new model.
clarify what to do when client certificate is requested but unavailable
clarify what is an inappropriate ClientKeyExchange
Normalize description of supported_signtaure_algorithms

Since each SignatureAndHashAlgorithm is 2 octets, and at least one
must be supported, the range is 2 - 2^16-2.

Note that cipher_suites is already declared in the same way:
CipherSuite cipher_suites<2..2^16-2>
Merge commit