Fix potential NULL dereference

We document that either of recv or recv_timeout may be NULL, but for TLS we
always used recv... Thanks Coverity for catching that.
(Not remotely trigerrable: local configuration.)

Also made me notice net_recv_timeout didn't do its job properly.
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index d75e93a..b7e361a 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -982,7 +982,7 @@
  * \param f_recv   read callback
  * \param f_recv_timeout blocking read callback with timeout.
  *                 The last argument is the timeout in milliseconds,
- *                 0 means no timeout
+ *                 0 means no timeout (block forever until a message comes)
  *
  * \note           One of f_recv or f_recv_timeout can be NULL, in which case
  *                 the other is used. If both are non-NULL, f_recv_timeout is