Add --ca-cert=FILE option for python 2.7.9ish

Bug #426

python 2.7.9 and 3.x have enabled SSL certificate verification by
default now.  However, when a site uses a self-signed cert, the local
system's CA certificate list likly won't include any self-signed
certs.

We need a way to let the s3cmd caller provide the cert.

This patch allows the caller to specify a path to the public CA cert
file for a given self-signed cert.  Command line option --ca-cert=FILE
is added.

We had to work around the fact that earlier pythons don't have the ssl
or httplib patches that are in 2.7.9 now.  So we test for the
existance of ssl.SSLContext attribute and
httplib.HTTPSConnection(context=) argument, and only use them if present.
Have CloudFront use ConnMan class

Related to Bug #426, CloudFront codepath was managing its own
HTTPSConnections, without using the ConnMan class.  We just added
support in ConnMan to let the user specify their CA cert file path.

This patch lets CloudFront use ConnMan to manage its connections.
create default context, then load in cert chain if needed

Must call ssl.create_default_context().

Must not call ssl._create_unverified_context(), it doesn't exist in
Fedora rawhide yet.
handle Debian/Fedora differences in new ssl libraries

Fedora doesn't have ssl._create_unverified_context()

ssl.create_default_context() takes the argument cafile=/path/to/file
so we don't have to load it seperately, which wasn't working on Debian.
Use ca_certs_file="" so it will load from ~/.s3cfg

In ~/.s3cfg, when ca_certs_file = None, it won't get picked up because
it's not of a type the config parser expects.  So, we need it to be ""
instead.

Then, ssl.create_default_context() expects cafile to be either None
(the default), or a string.  So, if we see the empty string, we send
it None instead.
Arch Linux 2014.12.01 and Fedora rawhide (will be F22) now includes
Python 2.7.9 which turns on SSL certificate validation.  This leads to
to a problem: The Amazon S3 wildcard certificate specifies
*.s3.amazonaws.com which does not match any DNS-style buckets.  So you
have to use --no-check-certificate for operations on these buckets.
finish merge with master

specifically, the handling of proxy servers conflicted.
Don't call set_tunnel() for http (not https) connections
add debug messages for http/https proxied/non-proxied connections
Merge pull request #431 from mdomsch/bug/426-specify-SSL-CA-file

Bug/426 specify ssl ca file