Clean up do_crypt code

Avoid unnecessary alloc/copy/free cycles and clean up structure in
general. Add a few extra checks for the key length.
Print supported key sizes in error message
Call mcrypt_module_close on error
Provide expected IV length in IV error messages
Remove a number of macros that are no longer used
Use zpp for accepting encryption mode string

Leaving the non-zpp usage for the mcrypt_{MODE} functions, as
they're deprecated and I'm too lazy to update all their tests.
Add NEWS entry for mcrypt changes
Merge branch 'PHP-5.6'
Merge branch 'master' of git.php.net:php-src
Merge branch 'PHP-5.6' of git.php.net:php-src into PHP-5.6
Refactor + reorganize openssl files

- All streams-related code now lives in xp_ssl.c. Previously
  stream code was split across both openssl.c and xp_ssl.c
- Folded superfluous php_openssl_structs.h into xp_ssl.c
- Server-specific options now set on SSL_CTX instead of SSL
- Deprecate SNI_server_name ctx option
- Miscellaneous refactoring
Raise timeout to 2s, reworded ssl timeout warning
Add encrypted server SNI support

- New "SNI_server_certs" context option maps host names to
  appropriate certs should client handshakes advertise the
  SNI extension:

    $ctx = stream_context_create(["ssl" => [
        "local_cert" => "/path/to/cert.pem",
        "SNI_server_certs" => [
            "domain1.com" => "/path/to/domain1.pem",
            "*.domain2.com" => "/path/to/domain2.pem",
            "domain3.com" => "/path/to/domain3.pem"
        ]
    ]]);

- Prefixing a "*." will utilize the matching cert if a client
  requests the primary host name or any subdomain thereof. So
  in the above example our "domain2.pem" will be used for both
  requests to "domain2.com" -and- "subdomain.domain2.com"
- The "SNI_server_certs" ctx option has no effect for client
  streams.
- SNI support is enabled by default as of 5.6 for both servers
  and clients. Servers must specify the "SNI_server_certs" array
  to actually use the SNI extension, though.
- If the `"SNI_enabled" => false` ctx option is also passed then
  "SNI_server_certs" has no effect.
- While supporting SNI by itself is enough to successfully
  negotiate the TLS handshake with many clients, servers MUST
  still specify a "local_cert" ctx option or run the risk of
  connection failures from clients that do not support the SNI
  extension.
Merge branch 'PHP-5.6'

* PHP-5.6:
  Add encrypted server SNI support
  Raise timeout to 2s, reworded ssl timeout warning
  Refactor + reorganize openssl files
Add NEWS/UPGRADING notes (openssl + curl)
Set default Digest Message to use SHA1 instead of MD5 in openssl tests
as MD5 signature are now rejected by newer openssl Version.

Noticed in RHEL-7 and Fedora 21 build.
Merge branch 'PHP-5.4' into PHP-5.5

* PHP-5.4:
  Set default Digest Message to use SHA1 instead of MD5 in openssl tests as MD5 signature are now rejected by newer openssl Version.
Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
  Set default Digest Message to use SHA1 instead of MD5 in openssl tests as MD5 signature are now rejected by newer openssl Version.
Merge branch 'PHP-5.6'

* PHP-5.6:
  Set default Digest Message to use SHA1 instead of MD5 in openssl tests as MD5 signature are now rejected by newer openssl Version.
  Add NEWS/UPGRADING notes (openssl + curl)
5.5.10 release date for NEWS