WIP: Add session hash and remote CCS

PR so this can be reviewed.
I think that this needs to be constructed a little more carefully once we talk about 0RTT.  Since the 0RTT handshake is likely to just be a time shift of the client handshake messages (moving the second flight up to the first), the order of the hash will change:

CH, CKS, SH, SKS, SE, SCertReq, SCert, SCertVerif, SFin, CCert, CCertVerif, CFin

As opposed to something where the CCert and CCertVerif (and maybe the CFin) appear earlier.  Some processing models will make this easy to get wrong.