Implement the V2ClientHello sniff in version-locked methods.

Tested manually by replacing SSLv23_method() with TLSv1_2_method() in
bssl_shim. This is a large chunk of code which is not run in SSLv23_method(),
but it will be run after unification. It's split out separately to ease review.

Change-Id: I6bd241daca17aa0f9b3e36e51864a29755a41097
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 8176b2a..f4d4775 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -1011,6 +1011,9 @@
 	if(s == NULL)
 	    return;
 
+	if (s->s3->sniff_buffer != NULL)
+		BUF_MEM_free(s->s3->sniff_buffer);
+
 	ssl3_cleanup_key_block(s);
 	if (s->s3->rbuf.buf != NULL)
 		ssl3_release_read_buffer(s);
@@ -1053,6 +1056,10 @@
 	 * ssl3_new. rbuf, wbuf, and init_extra are preserved, but
 	 * this may not serve anything more than saving a malloc. */
 
+	if (s->s3->sniff_buffer != NULL)
+		BUF_MEM_free(s->s3->sniff_buffer);
+	s->s3->sniff_buffer = NULL;
+
 	ssl3_cleanup_key_block(s);
 	if (s->s3->tmp.ca_names != NULL)
 		sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);