Fix downgrading of TOE TLS sockets to plain TOE.

[jhb]

Summary

If a TOE TLS socket ends up using an unsupported TLS version or
ciphersuite, it must be downgraded to a "plain" TOE socket with
TLS encryption/decryption performed on the host. The previous
implementation of this fallback was incomplete and resulted in
hung connections.