[TLS] Pull request for session hash

[Eric Rescorla <[e-mail]>]

I've created a preliminary pull request to adapt the session hash fix for
TLS 1.3
for feedback from the WG.

Points to note:

- IMPORTANT: Because the initial handshake messages are encrypted
  under separate keys from the application data traffic, it seems like we
need
  to have 2 sets of CCS messages or none. In anticipation of removing
  renegotiation (see PR https://github.com/tlswg/tls13-spec/pull/88).
  Based on conversations with Alfredo and Martin, it seemed easier
  to remove them. Warning: analysis needed here.

- I created a separate resumption master secret that is fed into the
  key hierarchy. This makes the description of that simpler but will
  need revisiting if we adopt either Rich's unification of session hash
  and tickets or Karthik's PSK-as-tickets unification, but that seemed
  like a separate issue.

- If we adopt the Update proposal we will also need to split the master
  keys into two directional keys, but that's distinct as well.

- I still need to add the names of the session hash authors t
  acknowledgements.

This will probably need another revision before it is ready for merging, but
I wanted to get it out there for feedback.

-Ekr