Do not treat errors as success

As discussed in #65 (at least two problems tackled there, so this does not yet suffice to close the ticket) the function sent to the OTP SSL libraries for supplemental certificate validation should fail by default, not succeed.

I have not been able to generate certificates that demonstrate the undesirable behavior for automated testing, but certificates originally created by @bkerley revealed the problem and were used to test this fix.
Good point about the anonymous bindings, will tweak that.

The `public_key` OTP library handles the real smarts here; our function just allows us to do some extra checks. By passing back what came in if we don't need to do anything, we're letting it make the real decisions. So if a failure or unknown status comes in, we'll let it decide what to do. It's the same as if we didn't supply the function at all.

See `pubkey_cert:verify_fun` if you'd like more context.