Refactor a tangle in ssl3_send_client_verify() into one function for each

Refactor a tangle in ssl3_send_client_verify() into one function for each
type, sigalgs/rsa/ec/gost.  Move a few special dances for GOST where they
belong now.  This prompted a fix for a long-standing bug with GOST client
certificate authentication where tls1_transcript_data() fails since the
transcript was already freed before.  Add a bit of missing error checking
and leave some further cleanup for later.

idea, guidance & ok jsing