Provide a callback for certificate validation

If the certificate validation fails (or always in the case of ssh),
let the user decide whether to allow the connection.

The data structure passed to the user is the native certificate
information from the underlying implementation, namely OpenSSL or
WinHTTP.
http: send the DER-encoded cert to the callback

Instead of the parsed data, we can ask OpenSSL to give us the
DER-encoded version of the certificate, which the user can then parse
and validate.
remote: add tests for the certificate callback
transport: always call the certificate check callback

We should let the user decide whether to cancel the connection or not
regardless of whether our checks have decided that the certificate is
fine. We provide our own assessment to the callback to let the user fall
back to our checks if they so desire.
ssh: do ssh cert info before asking for credentials

We know the host's key as soon as we connect, so we should perform the
check as soon as we can, before we bother with the user's credentials.
Bring certificate check back to the normal return code

Returning 0 lets the certificate check succeed. An error code is bubbled
up to the user.
winhttp: credential check on successful connect

On successful connection, still ask the user whether they accept the server's certificate, indicating that WinHTTP would let it though.
winhttp: only do certificate check for SSL

If we're not using SSL, don't call the user's certificate check callback.
winhttp: bring together request sending

We need to call WinHttpSendRequest() in three different places. Unify all in a single function to have a single place for the certificate check.
winhttp: set ignore security flags on user command

If the user returns 0 from the certificate check and we had certificate issues, set the options to ignore certificate errors and resend the request.
transport: move the cert type enum to types.h

This should make the mingw compiler happy.
net: remove support for outright ignoring certificates

This option make it easy to ignore anything about the server we're
connecting to, which is bad security practice. This was necessary as we
didn't use to expose detailed information about the certificate, but now
that we do, we should get rid of this.

If the user wants to ignore everything, they can still provide a
callback which ignores all the information passed.
ssh: add test for host key

Test that the certificate check callback gets the right fingerprint from
the host we're connecting to.
Merge remote-tracking branch 'upstream/master' into cmn/host-cert-info
net: use only structs to pass information about cert

Instead of spreading the data in function arguments, some of which
aren't used for ssh and having a struct only for ssh, use a struct for
both, using a common parent to pass to the callback.
script: use a parallel build on Travis
ssh: provide our own types for host key lengths

Instead of using the libssh2 defines, provide our own, which eases usage
as we do not need to check whether libgit2 was built with libssh2 or not.
ssh: expose both hashes

The user may have the data hashed as MD5 or SHA-1, so we should provide
both types for consumption.
winhttp: get rid of the cert ignore flag

This brings us back in line with the other transports.
ssh: skip the localhost cert check earlier

Skip it before we attempt to clone, as we would exit with -1 on systems
which do not have sshd running.