Fix bug that fetch-ocsp-response does not work with OpenSSL 1.1.0

The syntax of openssl ocsp -header option has been changed in OpenSSL
1.1.0.  And it now does not require -header option anymore.  It looks
like that it is workaround for 1.0.x versions.

nghttpx: Dynamic DNS

Add Windows CI via AppVeyor

At the moment, we use both resolvers, and if either one is not
DNS_STATUS_IDLE, the other one is also not DNS_STATUS_IDLE.  This may
change if we are going to configure DNS so that either A or AAAA
lookup is done.  In that case, it is better to just return
DNS_STATUS_ERROR in the diff.  This is because the calling side does
not expect DNS_STATUS_IDLE in that case.

This option controls how long cached DNS entries remain valid.

We have added "dns" parameter to backend option.  If specified, name
lookup is done dynamically.  If not, name lookup is done at start up,
or configuration reloading.  nghttpx caches DNS result including error
case in 30 seconds in this commit.  Later commit makes this
configurable.

DNS resolution is done asynchronously using c-ares library.

Accept content-length: 0 in 204 response

Normally, we don't have wait for child process to exit, since init can
take care of them.  But in containerized environment, pid 0 init might
not be available, and defunct processes can be piled up.  This commit
ensures that OCSP and neverbleed processes are waited for before
worker process exits.