[WIP] Make `ssl` module implementation injectable in SSL-related classes, remove `contrib.pyopenssl` and `packages.ssl_match_hostname` in favor of `backports.ssl`

Addresses #370.

Also tests both the standard and backported `ssl` implementations, skipping each if unavailable.

I've incorporated the `subjectAltName` support from the `contrib.pyopenssl` module and the `ndg-httpsclient` package into `backports.ssl` (thanks @kirkeby!), obviating the need for the former.

This shouldn't be merged yet (see TODO below), but feedback would be much appreciated (@shazow @lukasa @t-8ch).

TODO:
- ~~Vendor `backports.ssl`, rather than listing it in `test-requirements.txt` (currently undone for quicker iteration).~~
- [x] Figure out `install_requires`/`extras_requires` rules for `pyOpenSSL` and `pyasn1` in urllib3/`backports.ssl`.
- [x] Properly catch and re-throw more `pyOpenSSL` exceptions as their `ssl` equivalents.
- [x] Fix the hanging bug in the `backports.ssl` implementation of `TestHTTPS` - it's happening on Travis CI (though I've got it disabled for now), so it can't be just my machine. Could it be a bug in `pyOpenSSL` itself? Seems to be fixed by monkey-patching the Tornado dummy server's `ssl` with `backports.ssl.monkey.patch()`, so could also be an OpenSSL version problem.
I think we'd be better off doing something like `HTTPSConncetion.ssl = override_ssl` than making another param here.

I want to avoid new constructor params that don't vary from request to request. SSL feels like something you set once in your module and forget about it.