Support disabling client-side SSL renegotiation #53

Letting clients initiate SSL renegotiation is a know vector for CPU-based DoS attacks.

relayd has configruation syntax and code to remediate this problem, by allowing adminstrators to disable client-initiated renegotiation entirely (see patch against relayd here http://article.gmane.org/gmane.os.openbsd.tech/37341):

- ssl [no] client-renegotiation
  -> allows the interception of ("secure") client initiated
     renegotioations, which are considered a risk in DDoS scenarios
     because many CPU cycles can be burned this way on a single TCP
     connection without an obvious way for the administrator to 
     immediately know what's happening.

httpd should ideally support the same feature to mitigate against this type of attack. Perhaps renegotiation should be off by default, as applications using client-side certificates for authentication are a minority.