Now server can perform path validation without chaining DCID if a
remote peer does not change DCID as per spec.

Coalesces Initial and Handshake from server on probe.  Include
occasional PING in non-ACK eliciting packets.

Major rework of loss detection mechanism.  It turned out getting it
done is very hard.

It now defaults to 2 and includes CID exchanged during handshake.

The changed semantics will be implemented in the later commits.

write_single_frame_pkt() returns a packet length greater than the number of bytes it writes to the buffer. The returned length reflects a fake AEAD overhead, while this extra overhead is never written. As a result, ngtcp2_verify_stateless_reset_token() uses initialized data when reading the end of the packet. This causes noise when using a memory sanitizer.

Instead of installing key and iv with ngtcp2_conn_update_key, pass key
and iv buffers to ngtcp2_update_key and let application fill those
buffers.

Require token if the first packet is lost or reordered in order to
buffer the data coming from validated client only.

Embed ngtcp2_transport_params into ngtcp2_settings directly to avoid
conversion.

Original connection ID can now be specified directly to
ngtcp2_transport_params and can be passed to ngtcp2_conn_server_new
via ngtcp2_settings.  As a result, ngtcp2_conn_set_retry_ocid was
removed.