tls: state machine refactoring and small cleanups

It should now be the case that the existences of these two are
biconditional:

  - The proto.tcp dynamic structure for the underlying TCP state
  - The existence of a Lua registry entry for this socket object

As such, callbacks registered with the network stack can only exist, and
therefore only fire, when we're guaranteed to be pinned by the Lua
registry.  Dually, if we're pinned by the Lua registry, it's because we
are registered with the network stack.

Because the only correct way to program with these sockets is to use the
callback interface exposed by `:on()`, even if one is only sending or
only receiving, make the network callbacks check that Lua callbacks
exist for *some* eventuality.  If all possible callbacks are `nil`, then
drop the connection and, by so doing, release the pin held by the Lua
registry.

While here, normalize `tls` to `net` behavior on the "disconnection"
and "reconnection" (ick) callbacks; see tls_socket_last_call.