Integrate BoringSSL test suite (BoGo)

See https://github.com/google/boringssl/blob/master/ssl/test/PORTING.md and https://github.com/rustls/rustls/blob/main/rustls/examples/internal/bogo_shim.rs.

Issues
- [ ] Implement alerts
- [x] Detect missing key shares (MissingKeyShare-Server-TLS13)
- [ ] Detect duplicate key shares (DuplicateKeyShares-TLS13)
- [ ] Server doesn't correctly returns session ID (EmptySessionID-TLS13, Server-ShortSessionID-TLS13, Server-FullSessionID-TLS13)
- [ ] Server doesn't correctly handle too long session ID (Server-TooLongSessionID-TLS13)
- [ ] Server should accept any record version for compatibility reasons (LooseInitialRecordVersion-TLS13)
- [ ] `decrypt_handshake` should ignore `user_canceled` warning alert (SendUserCanceledAlerts-TLS13)
- [ ] `decrypt_handshake` doesn't handle (post-handshake) alerts (SendBogusAlertType, EmptyCertificateList-TLS13)
- [ ] `decrypt_handshake` must handle bad records/ciphertexts (TLSFatalBadPackets, TLS13-EmptyRecords, TLS13-OnlyPadding, SkipEarlyData-OmitEarlyDataExtension-TLS13, SkipEarlyData-Interleaved-TLS13)
- [ ] `decrypt_handshake` must handle invalid certificates (GarbageCertificate-Client-TLS13)
- [ ] handle key update (TooManyKeyUpdates, KeyUpdate-ToClient, KeyUpdate-ToServer, KeyUpdate-InvalidRequestMode, KeyUpdate-RequestACK)
- [ ] finish digest not checked (BadFinished-Client-TLS13, BadFinished-Server-TLS13)
- [ ] correctly handle HRR (UnnecessaryHelloRetryRequest-TLS13, SecondHelloRetryRequest-TLS13, *HelloRetryRequest*)
- [ ] check key usage bit (ECDSAKeyUsage-Client-TLS13)