Tor-proto: Out-of-band handshake support

Splitting this from #352 (closed) because it's differently tricky:

We need a way to perform a circuit-extension handshake from the point of view of a rendezvous circuit. That means starting a handshake, but rather than sending the handshake in a create2 or created2 cell, returning it to the caller. The caller can later say what the response was, and "finish" the handshake, adding another (virtual) encryption hop to the circuit.