Now that we have a static version of the default EC formats, also use it
for the server hello.

From OpenSSL.

ok miod@
X509at_add1_attr(): do not free stuff we did not allocate in the error path.
ok tedu@
X509_issuer_and_serial_hash(): do not leak memory if an error occurs during
the first EVP block.

ok tedu@
X509_STORE_new(): do not leak memory upon error.
X509_STORE_get1_certs(), X509_STORE_get1_crls(): check the result of
allocations.

ok tedu@
Check that the specified curve is one of the client preferences.

Based on OpenSSL.

ok miod@
There is not much point checking ecdhp is not NULL... twice.

ok miod@
Doh, rev 1.4 had left out one routine with both 32-bit and 64-bit code, where
the 64-bit code has to be disabled under OpenBSD/hppa.
Someone (TM) thought it was smart to save memory by using malloc(1) and
manual field fiddling to create an ASN1_INTEGER object, instead of using
M_ASN1_INTEGER_new() which will allocate sizeof(long) bytes.
That person had probably never looked into malloc(3) and never heard of
allocation size rounding.

Thus, replace the obfuscated code with M_ASN1_INTEGER_new() followed by
ASN1_INTEGER_set(), to achieve a similar result, without the need for
/* version == 0 */ comments.

ok bcook@
X509_TRUST_add(): check X509_TRUST_get0() return value before dereferencing it,
for it may be NULL. Do not leak memory upon error.

ok bcook@
X509v3_add_ext(): do not free stuff we did not allocate in the error path.
ok bcook@
Add a new API function SSL_CTX_use_certificate_chain() that allows to
read the PEM-encoded certificate chain from memory instead of a file.
This idea is derived from an older implementation in relayd that was
needed to use the function with a privep'ed process in a chroot.  Now
it is time to get it into LibreSSL to make the API more privsep-
friendly and to make it available for other programs and the ressl
library.

ok jsing@ miod@
Bump minor after adding SSL_CTX_use_certificate_chain().

ok jsing@ miod@