Throw FormatException rather than RuntimeException if authenticated
decryption fails.

This will make it easier for simplex transports to discard empty
connections.

This makes us Suite B compliant and saves 32 bytes per frame. The
AES/GCM implementation refuses to decrypt the frame header before
checking the MAC, so we have to use AES/CTR to peek at the header. The
header is still covered by the MAC, and we still check it after peeking!