Shuffle TLS NPN logic to libsecurity

Shuffle TLS NPN logic to libsecurity

Also, adds new config option tls-no-npn to fully disable NPN on selected
cache_peer or http(s)_port directives.

ICAPS services set TLS NPN to off by default to prevent NPN wrongly
advertising them as HTTPS connections. The semantic meaning of NPN is to
name the protocol which is being wrapped by TLS, in the case of ICAPS that
is ICAP/1.0 but Squid NPN callback is currently hard-coded to send 'http/1.1'