[WIP] Make `ssl` module implementation injectable in SSL-related classes, remove `contrib.pyopenssl` and `packages.ssl_match_hostname` in favor of `backports.ssl`

Addresses #370.

Also tests both the standard and backported `ssl` implementations, skipping each if unavailable.

I've incorporated the `subjectAltName` support from the `contrib.pyopenssl` module and the `ndg-httpsclient` package into `backports.ssl` (thanks @kirkeby!), obviating the need for the former.

This shouldn't be merged yet (see TODO below), but feedback would be much appreciated (@shazow @lukasa @t-8ch).

TODO:
- [ ] Vendor `backports.ssl`, rather than listing it in `test-requirements.txt` (currently undone for quicker iteration).
- [ ] Figure out `install_requires`/`extras_requires` rules for `pyOpenSSL` and `pyasn1` in urllib3/`backports.ssl`.
- [ ] Properly catch and re-throw `pyOpenSSL` exceptions as their `ssl` equivalents.
- [ ] Fix the hanging bug in the `backports.ssl` implementation of `TestHTTPS` - it's happening on Travis CI (I've got it disabled for now), so it can't be just my machine. Could it be a bug in `pyOpenSSL` itself? Seems to be fixed by monkey-patching the Tornado dummy server's `ssl` with `backports.ssl.monkey.patch()`, so could also be an OpenSSL version problem.