[WO-421] Rework host authentication

Allow pinning of arbitrary hosts

Add socket.oncert(pem) callback to Chrome shim with the pem-encoded
certificate