Properly handle the SSL error queue

Errors were not getting cleared from the queue between various OpenSSL
function calls. This was causing the error queue to contain misleading
information on subsequent calls to SSL_get_error.

One degenerate case was incorrect dispatching of errors after a failed
SSL_read. Conditions that simply should have lead to another call to
SSL_read were being treated as fatal. This was verified while stracing a
stud process and seeing read() return with EAGAIN and stud immediately
closing the socket fd and logging an SSL_read error.
Fix TLS setting to use TLS 1.x (support TLS 1.1/1.2)

When we run using "--tls" (default) we create the SSL context with a
TLSv1_*_method(), however, this _only_ supports TLS 1.0 connections. In
contrast, when we run with "--ssl" we use a SSLv23_*_method() which
allows all supported protocols. We block SSL 2.0 by passing in the
SSL_OP_NO_SSLv2 flag in SSL_CTX_set_options. This results in the
somewhat counterintuitive situation where the supported protocols are:

* --tls: TLS 1.0
* --ssl: SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2

This patch fixes the handling of "--tls" so that it supports TLS 1.x
while ensuring SSL 3.0 is blocked (SSL 2.0 is always blocked).

This all assumes an OpenSSL library capable of supports newer TLS
versions, otherwise, the above change will have no effect on stud's
behaviour (ie. --ssl supports SSL 3.0/TLS 1.0, --tls supports TLS 1.0).