Port dtls1_get_hello_verify to CBS.

Gives bounds checks and asserts that there's nothing after the cookie.

Change-Id: I8f9753e0c72670e9960f73a5722cefd9c02696a9
Reviewed-on: https://boringssl-review.googlesource.com/1507
Reviewed-by: Adam Langley <agl@google.com>