Put SSL_pending() call behind the new internal SSL API.

It seems likely that any SSL implementation will need a similar call, not
just OpenSSL.