Give --tlscertfingerprint with explicit digest alg

Embedding a hard-coded choice of SHA1 violates algorithmic agility;
rather than constrain to my preferred choice, this should be given as
part of the option.

Also switched the option name to contain `cert` because there are
multiple digest types available in this situation and we're matching the
certificate digest (everything issued), not the public key digest (which
would be constant as new certificates are issued for the same key).  We
might add support for pubkey-based fingerprints later.

Explicitly pull in Net::SSLeay, with a version constraint, since we now
rely upon it for a top-level feature.  We require v1.37.  Debian
oldstable (wheezy) is on 1.36, RHEL6 appears to be on 1.35.  Those are
old enough that we can't reasonably sustain support for them while
providing useful modern security features.

Make sure to debug-log when the FP check succeeds, so the user can see
feedback indicating that validation did actually occur.