Use newer Boost version and verify hash.

Use a specific OpenVPN version (2.3.5) so the build is normalized.

This closes #6296 and #6297.
afaik the github zip/tar.gz are generated automatically from each tag.
We coud do a `git verify-tag v2.3.6`, but is not signed by any of the listed on http://openvpn.net/index.php/open-source/documentation/sig.html
The signature is from "Gert Doering <gert@space.net>", key id: 65514975
Should we ask them to add that signature to their web page or something?
How do we know if we get the right public key for this?