nagios: add new custom-written check "check_ssl"

We currently have in our tree a check called "check_ssl_cert". This is a
horrible 900-line shell script, that forks a bunch of times to call to
openssl, as well as call to which, expect, timeout and even perl
(multiple times each) to do simple checks that aren't easily possible in
bash. This is very inefficient and is currently killing our Icinga
server.

We also have a check_cert check, written by us in Python that is really
rudimentary and unable to do even basic checks that we currently need.

Moreover, there is a number of alternatives out there, none of which
seem to be having the feature set & performance that we need.
Unfortunately, this means writing our own.

Python was quickly eliminated as the language of choice for this: Python
2's SSL doesn't verify hostnames, and Python 3 gained e.g. SNI support
only with 3.4 which is too new for our current Icinga server. Instead,
Perl is used for this, with a admittedly weird combination of the
high-level IO::Socket::SSL & low-level API calls to Net::SSLeay. Perl is
the language of choice for the monitoring community as well and this
also has the added benefit of using Nagios::Plugin suite to handle much
of the argument parsing, usage text & exit codes that Nagios/Icinga
plugins expect.

This new check supports:
 - IPv4 & IPv6 (if IO::Socket::INET6 is installed) and forcing to each
 - SSL certificate path & files (defaulting to /etc/ssl/certs)
 - Proper per-protocol host verification (e.g. RFC2818 rules for HTTP).
   This includes commonName, SANs, wildcards-in-SANs etc.
 - Subject/issuer pattern matching (e.g. --issuer GlobalSign)
 - Expiry (notAfter/notBefore) thresholds (warning/critical)
 - SNI
It does not support (yet):
 - STARTTLS, by speaking different protocols (LDAP, SMTP, POP3 etc.)

Change-Id: I8a6561a6a277a20b15e647e70c67ad3d756d07d7