SSL: rework restart state handling

As done by previous commits for ECC and ECDSA:
- use explicit state assignments rather than increment
- always place the state update right before the operation label

This will make it easier to add restart support for other operations later if
desired.

SSL-specific changes:
- remove useless states: when the last restartable operation on a message is
  complete, ssl->state is incremented already, so we don't need any additional
state update: ecrs_state is only meant to complement ssl->state
- rename remaining states consistently as <message>_<operation>
- move some labels closer to the actual operation when possible (no assignment
  to variables used after the label between its previous and current position)
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index f3cde7f..6d9420c 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -4554,7 +4554,7 @@
 
 #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
     if( ssl->handshake->ecrs_enabled &&
-        ssl->handshake->ecrs_state == ssl_ecrs_crt_parsed )
+        ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
     {
         goto crt_verify;
     }
@@ -4584,7 +4584,7 @@
 
 #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
     if( ssl->handshake->ecrs_enabled)
-        ssl->handshake->ecrs_state++;
+        ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
 
 crt_verify:
     if( ssl->handshake->ecrs_enabled)
@@ -4726,11 +4726,6 @@
 #endif /* MBEDTLS_DEBUG_C */
     }
 
-#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
-    if( ssl->handshake->ecrs_enabled)
-        ssl->handshake->ecrs_state++;
-#endif
-
     ssl->state++;
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );