[tls] Allow for scheduled traffic phase changes

There are several point within the TLS version 1.3 handshake sequence
at which a handshake message handler needs to transition one or both
ciphers to a new traffic phase, but the new cipher keys cannot be
calculated by the key schedule until the triggering handshake message
has been added to the transcript digest.

Handshake messages are added to the transcript digest only after the
message handler returns, to accommodate the fact that the transcript
digest algorithm cannot be known until the initial ServerHello has
been processed.

Allow a new traffic phase to be recorded in the cipher specification,
which will be activated after the handshake message handlers have
returned.

Changing traffic phase requires changing the cipher in use, and so is
permitted only for the last handshake message in a handshake record.

Signed-off-by: Michael Brown <mcb30@ipxe.org>