(maint) Correct parameter type from SSLContext to StoreContext

Previously, our verify callback stated that it received an SSLContext
parameter, but that is not correct. While there are SSLContext classes
in ruby, the actual object passed is of type StoreContext.

    (rdb:1) store_context.class
    OpenSSL::X509::StoreContext
(maint) Only append to peer_certs if verify succeeded

Previously, we assumed that verify_callback was only called once for each
cert in the chain, with preverify_ok set to true or false depending on
whether the cert is verified.

However, openssl call invoke the verify_callback for a number of other
reasons, e.g. CRL not yet valid. In that case, the error is not with
the current_cert, but with the current_crl.

This commit moves the logic for appending the current_cert to the
@peer_certs array only in the case that preverify_ok is true. Does not
cause problems, because we only looked at @peer_certs array if every
cert in the chain was successfully verified.

This commit makes it easier to handle other types of verify errors.
(PUP-894) Add specs for current bebavior

This commit adds specs for current behavior, especially that the verify
callback rejects the connection if preverify_ok is false, and we reject
CRLs whose last_update time is more than 5 minutes in the future.
(PUP-894) Accept CRLs that were "recently" updated

Previously, the agent would reject an SSL connection if the CRL it
downloaded from the CA had a `last_update` time that was slightly in the
future. The agent reports this as "CRL is not yet valid." This issue can
happen when the CA's time is slightly ahead of the agent's time, the CRL
is recently updated, and the agent doesn't already have a cached version
of the CRL (due to PUP-2103).

The CRL not yet valid error sometimes happens during acceptance testing
when we delete the agent's ssl directory, revoke a cert on the master
(which updates the CRL's last_update field), and run the agent (which
downloads the latest CRL).

This commit modifies the verify callback to ignore CRL not yet valid
errors provided all of the following are true:

 * current_crl is not nil
 * current_crl.last_update is not nil
 * current_crl.last_update is strictly less than 5 minutes from now

It also adds specs around unspecified behavior, e.g. ensure the verify
callback returns false when errors are detected.
Merge pull request #3068 from joshcooper/ticket/stable/PUP-894-crl-not-yet-valid

(PUP-894) Be more lenient about CRL not yet valid errors