Verify full cert chain to prevent false positives

Ensure full certificate chain is verified to:
- ensure full trust evaluation in pinning mode (certs were individually verified instead of full chain)
- prevent MITM hostname attacks (due to above)
- prevent MITM from foreign or compromised intermediate CA
- prevent MITM from incompatible cert chain

Previously, only a single certificate in the chain (root, intermediate, or otherwise) was necessary to return as valid. Also, the full trust wasn't being validated as a whole in pinning mode which means the hostname wasn't being validated, thus allowing a cert with a different hostname to be trusted as long as one of the certs in the chain are the same. Compromised CAs are an edge case, however it's been an issue every other year or so.

All tests are passing.

Updated:
added support for explicitly specifying whether to validate leafs or full chain

Other:
Tests should probably use SSL policies instead of X509 policies. This is more akin to NSURLProtectionSpaceHTTPS (used by nsurlconnection) which yields a trust with the SSL policy.