Devel/spki pinset via tlsa checking

[wtoorop]

• Resolves bug Decide how to handle OpenSSL errors that are ignorable #293
• Resolves bug no valid transports or upstreams available stubby#46

With OpenSSL >= 1.1.0 check SHA256 pins with OpenSSL native DANE functions
With OpenSSL >= 1.0.0 and < 1.1.0 uses Viktor's danessl library
With OpenSSL < 1.0.0 uses old method, but does not allow the exceptions (like self-signed certificates)
So for OpenSSL < 1.0.0 certificate authorities are a requirement, but the connection will fail authentication if the pin doesn't match.

[saradickinson]

@wtoorop Thanks for this. Will review/test tomorrow. As we discussed last week IIRC TLS 1.2 requires OpenSSL 1.0.1, so I'm not sure we need to cater for OpenSSL < 1.0.0 for authentication?

And thanks for extra work in getdns_query - was just about to remove i_am_stubby myself!!