Avoid malloc/free on each server-side ntor handshake

Now that we require c99, we can use variable-length array here instead of a malloc/free pair.