[WIP] SSL/TLS Support

This is a work in progress! Please do review and comment.

This PR is designed to do a few things:
1. The RemoteFilesystem class configures itself with default TLS options in line with PHP 5.6's adopted values if TLS protection has NOT been explicitly disabled by the user. This means Composer does everything possible to do HTTPS right - and lets the user shoulder the risk of disabling it. All instances are now created using Composer\Factory::createRemoteFilesystem().
2. Where any TLS option needs user input, e.g. a CA certificate file, we give them an error. They can now set a cafile option in config.json or pass a cafile option with value on CLI. If they can't/won't do that, they can resort to setting a disable-tls option in config.json or via CLI at their own risk.
3. Composer will distribute a cacert.pem file. This is used as a last resort option wherever possible and will be updated alongside Composer self-updates. There will need to be a process introduced to regularly check/update this file in the git repository.

This should resolve the TLS portion of https://github.com/composer/composer/issues/1074.

The Composer Installer is also being updated: https://github.com/composer/getcomposer.org/pull/61

TODO:
1. Most of the TLS configuration is unnecessary under PHP 5.6 since it does all this automatically from that version.
2. Documentation updates.

I'm hoping to complete the PR over the next week - but feel free to PR my fork (the tls-config branch).
We should have a way to disable peer verification like any other tool, including all browsers. Chrome for example will ask you whenever you try to access a website that uses a self-signed certificate and if accepted will show a `This certificate has not been verified by a third party` message on the address bar.

I am just not sure if `--disable-tls` is the right option name. Any communication on HTTPS will have the data encrypted with the certificate, be it verified by a Peer (eg: Thawte) or not. Perhaps `--verify-peer=false` describes the functionality better, unless `--disable-tls` is really disabling encryption. But IMO either the option or the description of the functionality needs to change.