padding of Server Initials fails if the certifictate is very small

[marten-seemann]

If the certificate is very small, the first packet will contain an Initial, Handshake and 1-RTT packet. This will cause a problem cause by padding the Initial, which we introduced in #2840.

In this case, we can't pad by appending 0s to the end of the packet, as the 1-RTT packet doesn't have a length field and always extends to the end of the packet. This will lead to the first packet ending up undecryptable for the client.

Unfortunately, the congestion controller on the server will notice this: As the the first packet is never acknowledged, the server will declare it lost, and start the connection in recovery. This is bad for throughput.