of ldap_start_tls_s().

rework internal handling of strings to minimize temporary allocation; impacts rewrite() and rewrite_session() behavior in case of no rewriting

LDAP_OPT_X_TLS_CONNECT_CB and LDAP_OPT_X_TLS_CONNECT_ARG
with int (LDAP_TLS_CONNECT_CB) (LDAP *ld, SSL *ssl, SSL_CTX *ctx, void *arg)
To be called whenever the client library allocates a new SSL* handle.

instead of recycling thru avl_find/avl_delete/avl_insert

- #ifdef'd CRL checking code.

with code to accept old values.