tests: add test coverage for custom HostnameVerifier

This required switching the TrustingSSLSocketFactory from using an
anonymous cipher suite to one that authenticates.  A test keystore is
used for this purpose.  It contains two self-signed certificates, one
each with alias (and CN) "localhost" and "bad.example.com".  The
TrustingSSLSocketFactory is no longer a singleton; it now
optionally takes a key alias as an argument.