* When there is buffered cleartext, return it without calling the
   underlying read function. This prevents buffer overflow due to space
   used up by cleartext.
 * Avoid clearing the buffer when the buffered cleartext could not be
   completely given to the result read buffer, and there is some
   buffered ciphertext left.
 * Instead of rounding up the amount of bytes to ask for to the nearest
   TLS record size, round down, with a minimum of 1. This prevents the
   code path from being taken which requires extra memory copies.
 * Avoid calling `@memcpy` with overlapping arguments.

closes #15590