treat GNUTLS_E_GOT_APPLICATION_DATA as non-fatal if initial negotiation is complete

This corrects a regression introduced in b5a0de2e6da98866cafb770c3141b7353d030ab2
Reported by Dan Winship. https://savannah.gnu.org/support/?108690
tests: added test for GNUTLS_E_GOT_APPLICATION_DATA on rehandshake

Conflicts:
	tests/Makefile.am
doc update
restore only the documented behavior
corrected memleak in read_key_mem()

Patch by Georg Richter.
_gnutls_x509_get_dn() always return a null terminated string
use the original DER/BER data when verifying an OCSP response

Conflicts:
	lib/x509/ocsp.c
deinitialize the OCSP response der data

That also makes sure that reinitialization of ASN1 structures
are done when it is required only.
utilize the gnutls 3.2 functions
doc update
bumped version
released 3.2.21
Merge commit '28660c200aa28236c0027ca2655f8b8b1eabdb48'
project: Update for recent merge.