Use SSL_get_certificate() hack for OpenSSL 0.9.8y

OpenSSL 0.9.8y also crashes in OpenSSL's SSL_get_certificate() on a
NULL pointer dereference.  Fix by also using the direct access hack
developed for OpenSSL 1.0.0k and 1.0.1e with OpenSSL 0.9.8y.
Update NEWS.md for OpenSSL 0.9.8y bug workaround
Fix uid/gid lookup where sysconf(_SC_GETPW_R_SIZE_MAX) fails

On some platforms, sysconf(_SC_GETPW_R_SIZE_MAX) compiles but never
succeeds (e.g. FreeBSD 8.4).  Fix this by dynamically enlarging an
initially small buffer until it is large enough, and reuse the
determined buffer size on subsequent calls to the same function.