Update shipped truststore to match Mozilla's shipped CAs

I don't think we should be maintaining our own set if at all possible, this
patch was created by creating a new keystore and inserting every certificate
from an Ubuntu system's Mozilla ca-certificates set:

rm -f ./src/security/truststore
for x in /usr/share/ca-certificates/mozilla/*.crt; do
	y=`basename -s .crt $x`
	keytool -import -storepass changeit -keystore ./src/security/truststore -alias $y -file $x -noprompt
done
OF-405 : Perform proper path validation on certificate chains

What this patch actually does is place existing certificates into a CertStore,
including those from its (untrusted) keystore, the trust store, and any from
the chain supplied by the peer, and then rebuild a chain back to a known trust
anchor (from the trust store).

This strategy will cope with unknown ICAs in chains, abbreviated chains, and so
on, and replaces attempts to specifically handle self-signed certificates.

That last said, there is an explicit shortcut to handle self-signed certificates
which are supplied as end-entity certificates. These are simply checked against
the trust store without any attempt to build a path.
OF-405 Addressing review comments from Simon White
OF-405 Addressing comments from Tom Evans

 - Always check validity of EE Cert
 - Change variable name (and flip sense).
OF-405 Comments from Sven Bunge addressed
Merge pull request #29 from surevine/dwd/OF-405

OF-405 - TLS certificate validation and authentication issues