Support sending 1-RTT packets on the server before handshake completi…

…on (#392)

src/connection/connection.rs

@@ -3022,7 +3022,13 @@ impl Connection {
         // If there are sendable, reset, stopped, almost full, blocked streams,
         // or need to update concurrency limits, use the 0RTT/1RTT packet.
         let path = self.paths.get(pid)?;
-        if (self.is_established() || self.tls_session.is_in_early_data())
+        if (self.is_established()
+            // Note: The server's use of 1-RTT keys before the handshake is
+            // complete is limited to sending data. BoringSSL will provide 1-RTT
+            // write secret until the handshake is complete.
+            // See RFC 9001 Section 5.7
+            || self.tls_session.get_keys(Level::OneRTT).seal.is_some()
+            || self.tls_session.is_in_early_data())
             && (self.need_send_handshake_done_frame()
                 || self.need_send_new_token_frame()
                 || self.local_error.as_ref().map_or(false, |e| e.is_app)