[RFC] Provide a callback for certificate validation

If the certificate validation fails (or always in the case of ssh),
let the user decide whether to allow the connection.

The data structure passed to the user is the native certificate
information from the underlying implementation, namely OpenSSL or
WinHTTP.

---

WinHTTP is not implemented yet, as I try to stay away from Windows.

I've gone with just passing the platform's native structure, which seems like the least horrible option. For ssh it's just a hash, so I did wrap it, but passing our own X.509 structure seems like asking for trouble. It's a bit unfortunate that a user would have to implement two slightly different logics if they want to deal with X.509 on unix and Windows, but I'm not sure how to fix that.

It's still an open question how to pass this information further to the bindings. I had hoped I could just get some raw data from OpenSSL which we could parse in a target language, but I have not been able to find a way.