Fix static library builds, clarify shared libs situation

Fix read-heap-buffer-overflow in decode_varint_param()

If `valuelen` is 0 and `p` equals `end`, decode_varint_param() reads an extra byte past the end of the buffer.

Prior to commit 4e955731, ngtcp2 was
built as shared library. That has changed into a static or shared
library depending on the BUILD_SHARED_LIBS option, but this option was
not documented and the comments were misleading. Rectify both issues.

Note that autotools builds both libraries by default, but the current
CMake config is only able to build one of them.

Static libraries have to be built as position-independent, otherwise
they cannot be linked into a shared library which is built
position-independent (-fPIC).

Without this, linking objects into libcurl.so fails with:

    /usr/bin/ld: libngtcp2.a(ngtcp2_conn.c.o): relocation R_X86_64_PC32 against symbol `__asan_option_detect_stack_use_after_return' can not be used when making a shared object; recompile with -fPIC

Fix detection of proper OpenSSL and GnuTLS libraries

Until mainline support of QUIC are present in OpenSSL and GnuTLS, be
sure to test whether the found library versions are the patched ones
since the version number check is insufficient. This fixes the default
build on a system where a new GnuTLS is present without the patches from
the GnuTLS tmp-quic branch.

Add new ENABLE_OPENSSL and ENABLE_GNUTLS CMake options to allow
explicitly disabling these libraries to mirror the --without-openssl and
the --without-gnutls functionality of autotools.

Partially addresses https://github.com/ngtcp2/ngtcp2/issues/238