Explicit material

This is mostly it; it gets rid of internal certs and keys loading and and instead plumbs the provided material throughout the stack, exposing some tools to create it in the first place.

The changes are centered around `Flow.security_parameters` - which got three and lost one field - and the new `X509` module. `Certificate` got its interface, hiding some details, and `X509` can be exported to the outside world. Certs are also more symmetrical wrt client vs. server, paving the way for client certs.

`Server` should be a little redone to avoid the possiblity of `assert false`'d branches, but I really wanted to limit the scope of thise one PR which is already quite hefty.

@hannesm This conflicts with f877f5a85dda745861569a015072e3f489c876dc as a good part of it was done a little before. I'll now try to review the other branch, rework this on top of your changes and PR-close you, or if you're quicker, feel free to do the opposite. Commits are chuncked with the reader in mind.