Fix g_return_if_fail / g_return_val_if_fail occurences
Fix an invalid pointer dereference in inf_text_chunk_get_segment()
Fix cleanup order of InfdDirectory
Fix missing return values in infinoted_plugin_document_stream_io_in()
Add additional assert statements

These avoid false positives of the clang static analyzer.
Add INF_GNUTLS_CERTIFICATE_VERIFICATION_ERROR domain
Allow to specify reason for certificate rejection
Change logic of certificate checking to be SSH-like

The "known hosts" file is changed to contain mappings from hostname to
certificate. This technique is also known as "certificate pinnng". The
certificate check is then performed as follows:

If the certificate is valid, then connect, and remove any entry in the known
hosts file.

If the certificate is invalid for a reason other than a hostname mismatch or
the CA not being trusted, then disconnect.

Otherwise, look up the name of the host in the "known hosts" file:

 * If the certificate that is saved for this host is equal to the one that
   was presented, then proceed.
 * If there is no entry, or if the certificate saved in the known hosts file
   is expired or revoked, then show a dialog asking whether to trust the
   connection (showing what the problem is (either hostname or CA untrusted)),
   and if yes, add it to the known hosts file
 * If the stored certificate is not the same as the one presented, then also
   show a dialog with a "this is strange, please make sure you only proceed
   if you expect this message otherwise contact the server administrator".
   Replace the certificate in the known hosts file if proceeding.

If the hostname matches the one in the certificate and if the certificate
is issued by a trusted CA, then proceed with the connection. If the
certificate is invalid