Add support for pre-resolution of an endpoint.

In some scenarios, unbound-ec2 cannot itself perform name
resolution. This breaks boto, which by default needs to resolve the
endpoint name to an IP address. Instead, we jump through a few hoops
to connect directly to an IP address while still validating that the
service at that address presents a valid certificate.
Switch from AWS_REGION to EC2_ENDPOINT and EC2_ENDPOINT_ADDRESS.
Update docs for s/AWS_REGION/EC2_ENDPOINT/