Let user decide what to do when an invalid certificate is received.

Most of the work here is just propagating the signal through webkit
layers up to the user interface.

There are limitations:
- The message is a simple BAlert and does not show much useful info
about the certificate
- There is no way to store exceptions (permanent or session) so the
alert pops several time for the same certificate, for each element of a
page loaded using it

Fixes #6493