NSS: fix incorrect multi-keyword parsing and support new ones
    
    - add multi_mask, negative_mask, and multi_strength
      + some keywords may describe multiple cipher suite parameters at once
    - fix masks decision tree
      + all masks have to fit the cipher suite to include it
    - correct 'action' evaluation
      + plus sign means ordering (which NSS does not support)
      + no sign presence means adding implicitly
    - extend keywords for new future ciphers
    
    Backporting: #1372349
    Resolves: #1243517