Support certificate validation callback

[ctz]

At the moment if SSL_CTX_set_verify is called with a non-NULL callback, we return an error. Instead, we should implement this. That will mean filling in an X509_STORE_CTX.

This should unlock nginx support for client authentication.

[cpu]

I bumped into this while implementing support for SSL_CONF_cmd(..., "VerifyMode", ...) where I was hoping to make an Nginx based integration test using ssl_conf_command VerifyMode ... for setting client auth as requested or required. Leaving a note here that when this is resolved we should add that integration test.

[tialaramex]

The source says:

            // supporting verify callbacks would mean we need to fully use
            // the openssl certificate verifier, because X509_STORE and
            // X509_STORE_CTX are both in libcrypto.

Am I correct in understanding that this makes such a change extremely invasive for all purposes such that if it were attempted those who don't need this feature must reckon with the enormous changes anyway?

I've been trying to size up a first bite of this elephant to attempt and I just want to check I was correct to say "OK that's like half an elephant on its own, so not a place to begin" before moving on, as this seemed initially like a relatively compact but useful piece of work.

[ctz]

Yeah this is pretty fraught, and would need to happen along with #17. I would not recommend it as a first issue :)