Allow configuration of how TLS should handle possible truncation attacks

**Issue by [jrudolph](https://github.com/jrudolph)**
_Tuesday Feb 10, 2015 at 15:16 GMT_
_Originally opened as https://github.com/akka/akka/issues/16825_

---

spray's latest version of SslTlsSupport is very strict in its handling of truncated messages. It turns out that there are several situations in combination with HTTP where some kind of truncation is likely to happen and produces warnings regularly. For https://groups.google.com/d/topic/spray-user/8FUAZ_QAfs4/discussion I made a quick test how current browser deal with potential truncation attacks and it seems that browsers are usually much more lenient than spray.

We should review that situation with akka-streams SSL implementation and maybe provide a configuration option about how to deal with possible truncation attacks.

See spray/spray#756.

/cc @sirthias

Start by reading spray's SslTlsSupport behavior and the akka-streams SSL implementation, then review the linked spray/spray#756 discussion and the browser-truncation test described in the issue. Done means the truncation-handling behavior has a clearly defined configuration option that addresses the HTTP cases without losing protection against possible attacks.

Written by the indexing model from the issue text.