io: return 0 for EOF in TLS session read after shutdown