generateKeyShare has nothing to do with Config receiver. It doesn't
configure anything. It has everything with connection so moved to Conn.
Making deriveECDHESecret also a method of Conn will make it possible to
access 'isClient' field.

serverHandshakeState::readClientHello was setting selected ALPN protocol
always on hs.hello.alpnProtocol, which is specific to TLS 1.2 and older.
Because of that server was marshalling ALPN to SH instead of EE.

see RFC7627

Before AEAD encryption data are stored in a buffer. Last possition
of this buffer store data type. When subsequent TLS record is shorter
than previous, the buffer is shrinked. This causes to remove data
type, which results in wrong MAC calculation. Only in case of TLS 1.3.

0 is used as a sentinel value when determining if the key share should
be marshalled.

The marshaller correctly checks the key_exchange length, but the test
code sometimes generated empty key_exchanges.

This reverts commit 1782162852.

* Drop DC test data for draft23

* DC: Change public key type

There was a last minute change to spec that changes the public key type
from a byte string of length at most 2^16 to a byte string of length at
most 2^24.

As per 4.2.1, client must abort with illegal_parameter in case it
gets version 0x0303 or older in supported_versions extensions

* includes AD in authentication check of TLS records

As per 5.2 of TLS 1.3 draft-28, the additional data is record header.

* tests: Update tests in order to support draft-28

* Interoperability: Updates NSS and BoringSSL versions to the
  one supporting draft-28
* Bogo: Updates revision number to use tests for draft-28
* FIX: makefile was using test-compat target instead of
  test-interop

* DC test: constify

* Use binary interface to encode in big-endian

The test in subcerts_test.go only passes if maxVersion ==
VersionTLS13Draft23. This is because DCs are cryptographically bound to
the protocol version on the wire. To work around this as we move towards
the RFC, this PR adds test data for VersionTLS13Draft28 and VersionTLS13
and uses maxVersion to pick which data to load.  # Please enter the
commit message for your changes. Lines starting

Drops support for delegated credentials with TLS 1.2 and adds the
protocol version and signature algorithm to the credential structure.

What's left are the minimal API changes required to use the delegated
credential extension in the TLS handshake.

This removes dependency on NewDelegatedCredential from tris.

Delegated credentials for TLS

This complies with the standard, currently an Internet draft:
https://tlswg.github.io/tls-subcerts/draft-ietf-tls-subcerts.html

It also adds a minimal interface for generating new delegated
credentials.

It's sufficient to pass in the *tls.Certificate (resp.
*x509.Certificate) to the server functions (resp. client funcctions),
but not necessary; the existing keyAgreement implementations only makes
use of the private key (resp. public key). Moreover, this change is
necessary for implementing the delegated credentials extension, which
replaces the private key (resp. public key) used in the handshake.

* Changes tests so that they pass with draft-23
* BoringSSL interoperability: uses code at most recent commit. It uses
  "-tls13-variant draft23" flag to indicate compatibility with draft23
* NSS interoperability: Uses release 3.35
* PicoTLS interoperability: blocked. Doesn't seem to implement draft23
* Uses updated bogo from
  https://github.com/henrydcase/crypto-tls-bogo-shim

Tris uses signature_algorithms_cert in order to advertise that it
doesn't support RSA-PSS. See GH#86 for more detailed discussion.

Fixes function name

Applies go fmt to all the code

* Makes building instructions for Ubuntu copy-paste'able
* Updates dependency list