Don't access the read_buffer directly in read_v2_client_hello

I missed a spot in https://boringssl-review.googlesource.com/21865. The
function is passed an input span and should just work with that span.
This does the exact same thing rigth now in == read_buffer.span() right
now. But we'll want this if we ever add a bytes-in/bytes-out API.

Change-Id: Ie12ad783b77b78335beba3a27da4d205ec828077
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/73547
Commit-Queue: Bob Beck <bbe@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Bob Beck <bbe@google.com>

ssl/s3_both.cc

diff --git a/ssl/s3_both.cc b/ssl/s3_both.cc
index 6912dc4..26b28c6 100644
--- a/ssl/s3_both.cc
+++ b/ssl/s3_both.cc
@@ -385,7 +385,7 @@
     return ssl_open_record_partial;
   }
 
-  CBS v2_client_hello = CBS(ssl->s3->read_buffer.span().subspan(2, msg_length));
+  CBS v2_client_hello = CBS(in.subspan(2, msg_length));
   // The V2ClientHello without the length is incorporated into the handshake
   // hash. This is only ever called at the start of the handshake, so hs is
   // guaranteed to be non-NULL.