Add support for sslmode=verify-ca

This is like verify-full, except the Common Name isn't matched against
the "host" parameter.