Don't allow CCS just before CertificateVerify in DTLS.

This is the DTLS-side equivalent of 6553b379e2.

Change-Id: I5eb7f9d6d5030e375baa1406b00e3166d276dc84
Reviewed-on: https://boringssl-review.googlesource.com/3027
Reviewed-by: Adam Langley <agl@google.com>

ssl/d1_srvr.c

@@ -430,8 +430,6 @@ int dtls1_accept(SSL *s) {
 
       case SSL3_ST_SR_CERT_VRFY_A:
       case SSL3_ST_SR_CERT_VRFY_B:
-        s->d1->change_cipher_spec_ok = 1;
-        /* we should decide if we expected this one */
         ret = ssl3_get_cert_verify(s);
         if (ret <= 0) {
           goto end;