[woahwhattheheck]

Fixes #440.

struct handshake_cookie holds x — the diffie-hellman private value, whose
being forgotten is what makes the PFS handshake forward-secret — and the two
diffie-hellman parameter MAC keys derived from the shared secret. All four
sites which free the cookie did so without wiping it:

• handshakefail()
• proto_handshake() at err1
• handshakedone(), which runs once per successful connection, at exactly the
  point where x has served its purpose
• proto_handshake_cancel()

Four insecure_memzero() calls and the include; no other change.

Why all four rather than only where x is populated

err1 is reached before the diffie-hellman value is ever generated, so
strictly it has nothing to protect. I wiped it anyway so that "the cookie is
always cleared before it is freed" is a property that holds without the reader
having to trace which paths populate what — the same reasoning as
scryptenc.c, which wipes dk at err1 on paths where it may never have
been filled in. Happy to drop that one if you would rather keep it exact.

The nonces and yh_* values in the cookie go over the wire in the clear, so
they are not the point here; they are simply covered by wiping the whole
structure, which is cheaper and less fragile than picking members.

[tokenjunkielabs]

Following up on first-reporter bug bounty #440. This PR is the woahwhattheheck carrier for the unwiped handshake cookie containing Diffie-Hellman private/key material. Please review the report/fix when convenient and classify #440 under the repository's published bug-bounty schedule, including the applicable payment route if it qualifies. I am not presuming a tier.