Normalize connection shutdown handling.

I originally tried to make things work so that the netsec client code gave
the client the option of closing the file descriptors if it wanted to, but
I was running into a problem where if TLS negotiation failed part of the
negotiation would be interpreted as connection data.  The code has been
changed to have the sockets close when the SSL BIO is released and to
have netsec_shutdown unconditionally close the file descriptors.