Add TLS receive read-ahead support

[Frauschi]

Summary

Adds TLS receive read-ahead support, gated behind WOLFSSL_TLS_READ_AHEAD
(--enable-readahead) and toggled at runtime via wolfSSL_set_read_ahead().
When enabled, the record-header read pulls a full record in one recv() so the
body arrives without a second syscall.

The receive window is configurable with
wolfSSL_CTX/SSL_set_default_read_buffer_len() (OpenSSL-compatible):

• 0 keeps the one-record default,
• a larger value coalesces several records per recv(),
• a smaller value caps the per-connection buffer footprint.

Records exceeding the window are still received correctly; the input buffer
grows on demand.

Includes docs, API tests, a benchmark toggle, and a bench script.

Branch state

Rebased onto current master; single commit.

Review fixes folded in

This branch already incorporates fixes for issues found in review:

• Window overflow / truncation (memory safety): the configurable window is
  clamped to WOLFSSL_MAX_READ_AHEAD_SZ (16 MB) at the setters, so a large
  caller-supplied size can no longer overflow the signed arithmetic in
  GetInputData_ex() to a negative value (which would skip GrowInputBuffer()
  and drive an oversized recv()), nor silently wrap the size_t→word32
  store.
• wolfSSL_has_pending() semantics: corrected the code comment and the
  doc note — a non-zero return may reflect a partial (incomplete) record, so
  the documented drain loop now advises calling wolfSSL_read() until
  WANT_READ rather than looping on has_pending() alone (which could spin).
• Test coverage: added test_wolfSSL_read_ahead_ctx_inherit covering the
  CTX-level setter/getter, CTX→SSL inheritance, NULL-argument paths, and the
  clamp.
• Preprocessor guards: aligned the read-ahead API declaration guard in
  ssl.h with the definitions in ssl.c and the underlying struct members
  (excludes OPENSSL_EXTRA_X509_SMALL, which never provided the fields).

Testing

• --enable-readahead --enable-debug: builds clean; the four read-ahead API
  tests pass (test_wolfSSL_read_ahead, _coalesced, _buffer_len,
  _ctx_inherit).
• --enable-opensslextra (read-ahead off): builds clean; the read-ahead tests
  correctly report skipped, exercising the setter clamp under the
  OPENSSL_EXTRA guard path.