Add ssl_context parameter to Connection classes

After creating a shim SSLContext class in urllib3.util.ssl_, we now want
to start accepting instances of that class in general so users can take
advantage of some features provided only on certain versions of Python.

The first step is to allow users to pass ssl_context to both
HTTPSConnection and VerifiedHTTPSConnection and then pass these down to
the shim ssl_wrap_socket function in urllib3.util.ssl_. This does not
yet account for use with PyOpenSSL.

---

So this basically just works except for the fact that the following will raise an InsecureRequestWarning:

```python
import ssl
import urllib3
import urllib3.util.ssl_ as ussl


context = ussl.SSLContext(ssl.PROTOCOL_SSLv23)
context.load_verify_locations('../requests/requests/cacert.pem')
context.verify_mode = ssl.CERT_REQUIRED

manager = urllib3.PoolManager(ssl_context=context)
resp = manager.urlopen('GET', 'https://api.github.com/users',
                       preload_content=False)
```

Because the way I wrote `urllib3.util.ssl_.ssl_wrap_socket`, any settings on the the context set needs to be confirmed when creating the pool manager, e.g., the following works:

```python
import ssl
import urllib3
import urllib3.util.ssl_ as ussl


context = ussl.SSLContext(ssl.PROTOCOL_SSLv23)
context.load_verify_locations('../requests/requests/cacert.pem')
context.verify_mode = ssl.CERT_REQUIRED

manager = urllib3.PoolManager(ssl_context=context,
                              cert_reqs=ssl.CERT_REQUIRED)
resp = manager.urlopen('GET', 'https://api.github.com/users',
                       preload_content=False)
```

I think if we have `urllib3.util.ssl_.ssl_wrap_socket` return early when given a valid context, we won't break any prior behaviour, but I have yet to test that. Does anyone have any thoughts?
Well it wouldn't all be in ``__init__``. It'd be something like this:

```python
class HTTPSConnection(HTTPConnection):
    ssl_version = None

    def __init__(..., cert_file=None, key_file=None, ssl_context=None):
        if (cert_file is not None or key_file is not None) and ssl_context is not None:
            raise TypeError("Cannot specify both ssl_context and either cert_file or key_file")

        if ssl_context is None:
            ssl_context = create_urllib3_context(
                ssl_version=resolve_ssl_version(self.ssl_version),
                cert_reqs=ssl.CERT_NONE,
            )

            if cert_file:
                context.load_cert_chain(cert_file, key_file)

        self.ssl_context = ssl_context


class VerifiedHTTPSConnection(HTTPSConnection):

    def set_cert(self, key_file=None, cert_file=None,
                 cert_reqs=None, ca_certs=None,
                 assert_hostname=None, assert_fingerprint=None):
        self.assert_hostname = assert_hostname
        self.assert_fingerprint = assert_fingerprint

        self.ssl_context.verify_mode = resolve_cert_reqs(cert_reqs)

        if cert_file:
            self.ssl_context.load_cert_chain(cert_file, key_file)

        if ca_certs:
            self.ssl_context.load_verify_locations(ca_certs)

    def connect(self):
        # Other crap goes here

        if HAS_SNI:
            self.sock = self.ssl_context.wrap_socket(conn, server_hostname=hostname)
        else:
            self.sock = self.ssl_context.wrap_socket(conn)

        # Other crap goes here
```

I think I find this way clearer. You get or create a ``SSLContext()``, and then your ``set_cert`` function just updates that single context, and finally you wrap your socket with it. It clearly makes the ``SSLContext`` instance the thing that controls the SSL settings.