[TLS] Making post-handshake messages optional in TLS 1.3 (#676)

[Nick Sullivan <[e-mail]>]

There has been a lot of discussion lately about post-handshake messages
that do not contain application data and how to handle them. This PR is an
attempt to make the story more explicit by adding a new post_handshake
extension to TLS 1.3.

Supporting all types of post-handshake messages can require extra
complexity and logic, even when the features that these messages enable are
not needed. Some types of connections/implementations don't need to support
key updates (some unidirectional connections), session tickets (pure PSK
implementations) and post-handshake client auth (most browsers). These are
all currently SHOULDs in the spec and they don't need to be.

In order to simplify the logic around dealing with post-handshake messages,
this proposal makes support for each of these modes explicit via a new
handshake extension. This change also makes the path to introducing other
types of post-handshake messages in future drafts more explicit.

PR:
https://github.com/tlswg/tls13-spec/pull/676

Nick