Issue warning when certificate has no subjectAltName

Related bug: #497
I wasn't sure which we should be using. I think using `SecurityWarning` is acceptable because it is security-related. That said, I'm fine with it being a DeprecationWarning. The problem is, we can't actually deprecate this since `match_hostname` is a backported/stdlib function.

We could write our own that short circuits (or just short circuits here) but, I'm not sure if we want to take on that maintenance responsibility.