configuration parser: ensure tun_mtu is greater than the crypto overhead

[hannesm]

at the moment, State.mtu : Conf_map.t -> bool -> int computes the amount of data bytes a tunnel can carry (by taking Tun_mtu and subtracting the overhead imposed by (a) hmac (b) iv (c) header (d) padding). This function asserts if the remainder is <= 0. Instead, we should be able to compute the overhead and check the configuration (and PUSH_REPLY) that the Tun_mtu is always greater -- it needs to be more than 20 bytes (for the IPv4 header) as well, and likely does not make sense to be < 28. Maybe a more reasonable minimum is 576, to-be-re-read in RFCs (or https://en.wikipedia.org/wiki/Maximum_transmission_unit) -- original comment #37 (comment)