Allow the clients to decide if validation of SSL certificates should be skipped

Instead of just assuming that in DEBUG root certificates should not be evaluated allow the callers to decide.
In order to not break existing clients, in DEBUG evaluation still is off, but in release builds you can set the allowUntrustedSSLCertificates flag.
I'd add a comment here specifying what it does, what the default value is, and specifically note that it only applies to non-DEBUG builds.