Implement a custom KeyManager to force an SSLContext to always use the HTTPS key alias.

Kerplapp has one keypair and two certificates in its keystore. The first
certificate is generated on first run and is used for signing the index.jar. The
second certificate is regenerated as required and contains the current IP used
for the HTTPS server. This certificate must be regenerated whenever the IP
changes. Using the default KeyManager is unreliable: it sometimes uses the
index.jar certificate and not the https certificate. In order to force the use
of the HTTPS certificate we provide a wrapped KeyManager that forces the right
alias to be used. Convoluted, but the only apparent solution outside of
managing two entirely separate keystores with two copies of the private key
and only one certificate per keystore.

This should be the last requirement for issue #2669
Provide KeyManagers to HTTPD directly instead of using the KeyManagerFactory.

The KerplappKeyStore now provides a wrapped KeyManager that should be used
instead of a vanilla KeyManagerFactory. We use the new NanoHTTPD method to
accept direct KeyManagers instead of letting it collect its own from
a KeyManagerFactory instance.