Harden retry processing

[huitema]

The first version of the retry processing was limiting CPU and memory consumption in an indirect way: if there were too many connection in progress, picoquic would send a "stateless retry" packet to the peer, and the connection would not progress until an initial packet was received with the correct token. The CPU consumption was limited, because the expensive asymmetrical key operations would only happen after the retry/token handshake, but the memory consumption would still grow quickly, because each "initial" packet caused creation of a connection context (about 5KB). These contexts would only be freed after a timer, and thus the memory consumption could be large.

This PR ensures that no context is created if the initial packet is not "accepted". The picoquic server will simply queue a "stateless packet" containing either the "retry" packet or an initial packet with a connection close frame stating "server busy".

The "cnx_ddos" test has been updated to verify that not to many contexts are created.