allow performing *only* fingerprint verification

Before if we verified a fingerprint we also required a valid certificate.
Valid in 'signed by a trusted CA, current time in valid timerange', not in the
sense of matching hostnames.
We should allow people to verify certificates via fingerprints that are totally
crap otherwise.
Merge pull request #444 from t-8ch/tls_fingerprints_noverify

Allow performing *only* fingerprint verification.
CHANGES for #444
warn if the system time is wrong
s/TimeOutOfSyncWarning/SystemTimeWarning/g
Introduce SecurityWarning
update warnings on wrong system time

Incorporates ideas by @shazow and adds tests.
fix message wrap and format string
remove crap accidentally commited
Fix _validate_conn for AppEngine? (cc #446)
Document MaxRetryError parameters.
add missing space to warning message
make our WrappedSocket compatible with pypy

The changes are inspired by socket.py from pypy and the implementation is
lifted from ssl.py from pypy.
fix makefile refs
test everything on pyopenssl
fix contrib.pyopenssl on python3

On python3 import ndg.httpsclient will result in a syntax error.
always test PyOpenSSL on python2
raise timeout with an argument

The arguments are compared in the socket module, and this is the value the
stdlib uses
visually clean up imports
add note about dev-requirements on python3