Add support for matching server cert by hash.

By setting ServerCertificateSHA256 to a hex-encoded, SHA-256 hash in the
config, normal X.509 verification is disabled and the server certificate
must exactly match the given hash.

Fixes #17.