wip: ssl-verify

So, the issue here is that we need to be able to edit the `SslContext` before handing it to `SslStream`. Currently, if you want to do this, you must implement a new NetworkStream. But we'd like to be able to provide an option to the upcoming `Client` to adjust this, without forcing a user to implement new guts.

This design accomplishes this, but it makes the API gross, since so many things must be generic. Unboxed closures makes it worse, since those are generic also, instead of just asking for a `proc`.

The possible excuse here is that this is the low level API, and no user should ever actually access these APIs; they should be using the new `Client` struct instead.

@reem don't shoot me