ssl: separate locking init from general init

Extract the lock-setting functions into their own, as we cannot assume
that it's ok for us to set this unconditionally.
docs: explicitly document the threading caveats

Talk about sharing objects and error messages; but the most important
part is about what to do with the cryptographic libraries, which sadly
have to become to responsibility of the application.