Collect badness values in ntor_ref.py; don't just clobber.

Fixes bug 15591; patch from joelanders

changes/bug15591

@@ -0,0 +1,4 @@
+  o Testing:
+    - Check for matching value in server response in ntor_ref.py.
+      Fixes bug 15591; bugfix on 0.2.4.8-alpha. Reported and fixed
+      by "joelanders".

src/test/ntor_ref.py

@@ -283,7 +283,7 @@ def client_part2(seckey_x, msg, node_id, pubkey_B, keyBytes=72):
     my_auth = H_mac(auth_input)
 
     badness = my_auth != their_auth
-    badness = bad_result(yx) + bad_result(bx)
+    badness |= bad_result(yx) + bad_result(bx)
 
     if badness:
         return None