Round up cwnd left to the maximum UDP packet size to avoid small
packet.

This commit separates key installation function into 2 and let TLS
stack install rx and tx keys separately for handshake and 1RTT keys.
This change is aligned to the new BoringSSL API and GnuTLS API.  I
expect that OpenSSL will follow this change.  It also removes side
argument from crypto API if it can be inferred by
ngtcp2_conn_is_server.

Fixes #224

This commit adds special handling for the very first Initial packet
which is corrupted and discarded.  If server receives such packet, it
has to drop connection silently without sending any CONNECTION_CLOSE.
Then valid packet might come later.  Keeping connection state is
harmful because corrupted packet has wrong SCID, which drops later
valid packet because mismatched SCID.  New error code
NGTCP2_ERR_DROP_CONN is added which tells server application to drop
connection silently.

Remove conn and user_data from encrypt/decrypt/hp_mask callbacks so
that they can be used without conn.

Bring back the processing of Handshake packets.  Doing so can reset
idle timer and reset PTO count which is useful to deal with packet
loss during handshake.

Now server can perform path validation without chaining DCID if a
remote peer does not change DCID as per spec.

Coalesces Initial and Handshake from server on probe.  Include
occasional PING in non-ACK eliciting packets.

Major rework of loss detection mechanism.  It turned out getting it
done is very hard.

It now defaults to 2 and includes CID exchanged during handshake.

The changed semantics will be implemented in the later commits.