Add a bunch of scopers.

I started by switching a couple fields to SSL_HANDSHAKE and then kept
following transitive bits.

Bug: 132
Change-Id: I640dadd3558615fa38c7e8498d4efe7449b0658f
Reviewed-on: https://boringssl-review.googlesource.com/18245
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

ssl/ssl_lib.cc

diff --git a/ssl/ssl_lib.cc b/ssl/ssl_lib.cc
index 28e6cc0..8e7bd88 100644
--- a/ssl/ssl_lib.cc
+++ b/ssl/ssl_lib.cc
@@ -1085,8 +1085,7 @@
 
   hs->wait = ssl_hs_ok;
   hs->in_early_data = 0;
-  SSL_SESSION_free(hs->early_session);
-  hs->early_session = NULL;
+  hs->early_session.reset();
 
   /* Discard any unfinished writes from the perspective of |SSL_write|'s
    * retry. The handshake will transparently flush out the pending record
@@ -1730,7 +1729,7 @@
 
   /* During the handshake, report the handshake value. */
   if (ssl->s3->hs != NULL) {
-    return ssl->s3->hs->hostname;
+    return ssl->s3->hs->hostname.get();
   }
 
   /* SSL_get_servername may also be called after the handshake to look up the