Only search for mark in expected space.

We know in which array slice the mark is expected.  As a result, we don't have
to look any further than that.  Patch by Yawning Angel.  See the following
ticket for reference: <https://bugs.torproject.org/11092>.
Add and use const.MAX_HANDSHAKE_LENGTH.
Stop processing data after authentication failed.

If the client did not authenticate after MAX_HANDSHAKE_LENGTH bytes,
authentication has failed.  For obfuscation, we keep the connection open a
while longer but we stop processing all data from that point on to prevent
denial-of-service attacks.  (Partial) patch by Yawning Angel.
For previous discussion, see: <https://bugs.torproject.org/11092>.
Increase closing threshold.

Since we no longer process data after authentication has failed, we might as
well increase the closing threshold.  The larger interval hopefully makes
ScrambleSuit bridges less fingerprintable for active adversaries.