SSL Button fixes

- Use OU as display name if CN is empty (often true for CA/interm. certs)
- Handle trust anchors in intermediate chain gracefully
Updater: Fix corner cases related to failed auto-updates

- Don't re-download updates whom's auto-install has clearly failed before
- Don't signal newly available auto-upgrade if it has failed once
- Remove downloaded update after (un)successful auto-update
- Remove as many temporary keys after an (un)successful auto-update