Remove conn and user_data from encrypt/decrypt/hp_mask callbacks so
that they can be used without conn.

Bring back the processing of Handshake packets.  Doing so can reset
idle timer and reset PTO count which is useful to deal with packet
loss during handshake.

Now server can perform path validation without chaining DCID if a
remote peer does not change DCID as per spec.

Coalesces Initial and Handshake from server on probe.  Include
occasional PING in non-ACK eliciting packets.

Major rework of loss detection mechanism.  It turned out getting it
done is very hard.

It now defaults to 2 and includes CID exchanged during handshake.

The changed semantics will be implemented in the later commits.

write_single_frame_pkt() returns a packet length greater than the number of bytes it writes to the buffer. The returned length reflects a fake AEAD overhead, while this extra overhead is never written. As a result, ngtcp2_verify_stateless_reset_token() uses initialized data when reading the end of the packet. This causes noise when using a memory sanitizer.

Instead of installing key and iv with ngtcp2_conn_update_key, pass key
and iv buffers to ngtcp2_update_key and let application fill those
buffers.

Require token if the first packet is lost or reordered in order to
buffer the data coming from validated client only.