Implement CBC record splitting.

This patch removes support for empty records (which is almost
universally disabled via SSL_OP_ALL) and adds optional support for
1/n-1 record splitting.

The latter is not enabled by default, since it's not typically used
on servers, but it should be enabled in web browsers since there are
known attacks in that case (see BEAST).

Bug: 11514124
Change-Id: I3fef273edd417c51c5723d290656d2e03331d68a