New SSL pinning.

Regarding #1852 and #1891, here is an attempt to fix the current SSL pinning implementation:

* In case of `validatesDomainName = YES`, we are now explicitly using `SecPolicyCreateSSL` which also validated the domain name. Im not relying on the current policy of the trust here, because this might change in a future version (/cc @ericallam). I think being explicit is the better choice.
* In case of `validatesDomainName = NO`, the policy will be `SecPolicyCreateBasicX509`.

##### `AFSSLPinningModeCertificate`:
* we are now using `SecTrustSetAnchorCertificates` which lets us explicitly specifies all certificates we want to trust.

##### `AFSSLPinningModePublicKey`:
* The number of trusted public keys determines if the server should be trusted.