At the moment, SSL connections where the ssl_established event does not fire are not logged.

That means that, for example, connections that are terminated with an alert during the
handshake never appear in the ssl.log.

This patch changes this behavior - now all ssl connections that fire any event are logged.

The protocol confirmation of the ssl analyzer is moved to the client_hello instead to
the server hello. Furthermore, an additional field is added to ssl.log, which indicates
if a connection has been established or not (which probably indicates a handshake problem).
update test baselines
only call disable_analyzer if the connection is still open.
Merge remote-tracking branch 'origin/topic/bernhard/ssl-failure'

* origin/topic/bernhard/ssl-failure:
  only call disable_analyzer if the connection is still open.
  update test baselines
  At the moment, SSL connections where the ssl_established event does not fire are not logged.