Since we don't support ADH ciphers can just ignore DH-*

Note that OpenSSL defines the DH- ciphers but does not implement
them so the DH string support is there only for compatibility.

I used to have a separate set of options when comparing the
NSS and OpenSSL ciphers. These differed between tests, sometimes
being just a difference in order. This just made the tests
hard to understand.

The AESGCM test was duplicated. Remove one.

Two different tests were in test_AES_no_ECDH. I broke one out
separately.

Fetches https://www.google.com and just looks for a 200 response.

This adds implicit requirement that the test machine has Internet
access so I might have to remove this eventually, but it at
least exercises that code in a positive test case.

Update gencert to do a better job parsing arguments so I can
pass in a --test flag to generate a special test-only user
certificate to test colons in the DN.

Use the %p option to generate separate logs for each process
with valgrind.