Add OpenSSL.crypto.verify_chain method.

This change adds support for verifying a certificate or a certificate
chain. This implementation uses OpenSSL's underlying X509_STORE_CTX_*
class of functions to accomplish this.

This change also adds an intermediate signing certificate/key and a
service certificate/key signed with the intermediate signing
certificate, to make testing the OpenSSL.crypto.verify_chain method
easier to test. I figured I would add it to the top level module so
other people can use an intermediate signing certificate in their own
tests.

Issue: https://github.com/pyca/pyopenssl/issues/154
Thanks for the feedback!

> Lines 2320 - 2325 are adding application logic on top of the OpenSSL API. I prefer to avoid this where possible. I suggest providing a thinner layer wrapping this OpenSSL API instead.

The OpenSSL API exposed in this change is:

```c
// From ./crypto/x509/x509_vfy.c
int X509_verify_cert(X509_STORE_CTX *ctx)
```

The API is pretty simple. The change does add a little application code to build up the ctx, but I don't think it is too much and we could easily make it customizable in this or future changes.

> It's a little bit difficult for me to see what exactly that thinner layer should be since this particular OpenSSL API seems confusing and overly complicated and to cross a couple layers (at least one of which I also don't really understand - what is an X509_STORE_CTX and why is it a different thing from an X509_STORE?).

I understand the X509_STORE_CTX to be an object whose purpose is purely for chain validation, which differs from an X509_STORE in that the store is just a container. From what browsing I did of this object's use in OpenSSL it seems it does things like allows you to set trust stores, set custom validation procedures, report validation errors with context and (much) more. If you grep through OpenSSL for X509_STORE_CTX you'll find lots more stuff.

I'm not claiming to be an expert in this area, so feedback is happily accepted here. See my note down below, though, about what I used as an inspiration for this change.

> My first guess would be that the API should be more like X509Store.verify(certificate, additional_certificates=None, crls=None, verify_param=None, default=None).

I think this is exactly what the X509_STORE_CTX is for: it is an X509_STORE with a bunch of extra context that you identified above. Instead of this API, I would be more inclined to use your suggestion later that adds a new X509StoreContext type that exposes these knobs. But, the top level OpenSSL.crypto.verify_chain function would still exist, it would just take a X509StoreContext object instead of the component parts that I accept now in this PR.

> It may also be that what's actually appropriate is to have an X509StoreContext type with a verify method - along with set_chain, set_param, set_default, etc methods. This would parallel the way other classes have been defined in pyOpenSSL.

I thought about this, too, and mostly agree. I eventually did not expose X509_STORE_CTX because it was only used in certificate chain validation in this single place, so I thought it would be safe/reasonable to hide it behind the OpenSSL.crypto.verify_chain method.

What you suggested above though makes me think maybe I ought to expose the entire object so that this or future changes can expose the ability to customize the verification process more.

> What would be really nice is to get input from someone who is actually somewhat familiar with this collection of APIs (in particular, with the X509_STORE and X509_STORE_CTX structure) to explain what the general idea is here. Without an understanding of the big picture or the abstract problem these APIs are supposed to be solving it's difficult to design a good API (even if that API isn't supposed to be novel and is only supposed to re-expose the existing OpenSSL API).

I agree 100%. For reference, I used the implementation of the pkcs12 subcommand from OpenSSL. See app/pkcs12.c for complete code, but here is an important snippet.

```c
830 /* Given a single certificate return a verified chain or NULL if error */                                                                                                            
831                                                                                                                                                                                      
832 /* Hope this is OK .... */                                                                                                                                                           
833                                                                                                                                                                                      
834 int get_cert_chain (X509 *cert, X509_STORE *store, STACK_OF(X509) **chain)                                                                                                           
835 {                                                                                                                                                                                    
836         X509_STORE_CTX store_ctx;                                                                                                                                                    
837         STACK_OF(X509) *chn;                                                                                                                                                         
838         int i = 0;                                                                                                                                                                   
839                                                                                                                                                                                      
840         /* FIXME: Should really check the return status of X509_STORE_CTX_init                                                                                                       
841          * for an error, but how that fits into the return value of this                                                                                                             
842          * function is less obvious. */                                                                                                                                              
843         X509_STORE_CTX_init(&store_ctx, store, cert, NULL);                                                                                                                          
844         if (X509_verify_cert(&store_ctx) <= 0) {                                                                                                                                     
845                 i = X509_STORE_CTX_get_error (&store_ctx);                                                                                                                           
846                 if (i == 0)                                                                                                                                                          
847                         /* avoid returning 0 if X509_verify_cert() did not                                                                                                           
848                          * set an appropriate error value in the context */                                                                                                          
849                         i = -1;                                                                                                                                                      
850                 chn = NULL;                                                                                                                                                          
851                 goto err;                                                                                                                                                            
852         } else                                                                                                                                                                       
853                 chn = X509_STORE_CTX_get1_chain(&store_ctx);                                                                                                                         
854 err:                                                                                                                                                                                 
855         X509_STORE_CTX_cleanup(&store_ctx);                                                                                                                                          
856         *chain = chn;                                                                                                                                                                
857                                                                                                                                                                                      
858         return i;                                                                                                                                                                    
859 }
``` 

So, as an action item, can I say that we should expose X509StoreContext as an object and leave notes to expose all the additional methods? Then, adjust the OpenSSL.crypto.verify_chain to accept a X509StoreContext.

Phew, that was a lot. =D