Fix certificate authentication for incoming s2s connections

ejabberd 13.x refuses incoming s2s connections when TLS is used and the peer's certificate is verified successfully but doesn't contain an [XmppAddr identifier as a subjectAltName][1].  The problem can currently be reproduced, for example, by trying to join `ejabberd@conference.jabber.ru` using a [dukgo.com][2] account.  This happens due to a combination of two issues:

1. In order to decide whether to offer `SASL EXTERNAL` authentication, ejabberd verifies the remote server's certificate _without_ checking the host name.  If this verification succeeds, ejabberd offers (and the remote server usually chooses) `EXTERNAL` authentication.
2. Then, when the remote server requested `EXTERNAL` authentication, ejabberd re-verifies the peer certificate and this time also the host name.  This fails due to type errors in the verification code that were introduced by the [switch to binary strings][3] (unless the certificate contains an XmppAddr identifier). Due to this host name verification failure, ejabberd aborts the connection.

My commits fix these type errors and let ejabberd check the host name before offering `SASL EXTERNAL` authentication, as suggested by the current version of [XEP-0178][4].

Thanks go to the Prosody developers who noted the issue and were very helpful while tracking down the details.

[1]: http://tools.ietf.org/html/rfc6120#section-13.7.1.4
[2]: https://duck.co/blog/using-pidgin-with-xmpp-jabber
[3]: https://github.com/processone/ejabberd/commit/9deb294328bb3f9eb6bd2c0e7cd500732e9b5830
[4]: http://xmpp.org/extensions/xep-0178.html#s2s