Restore the 0.2 TLS verification behavior.

[nelhage]

cc @armon -- I'd probably like to write more tests before merging this, but can you ACK that this looks like the right track to you before I do so?

---

Namely, don't check the DNS names in TLS certificates when connecting to
other servers.

As of golang 1.3, crypto/tls no longer natively supports doing partial
verification (verifying the cert issuer but not the hostname), so we
have to disable verification entirely and then do the issuer
verification ourselves. Fortunately, crypto/x509 makes this relatively
straightforward.

If the "server_name" configuration option is passed, we preserve the
existing behavior of checking that server name everywhere.

No option is provided to retain the current behavior of checking the
remote certificate against the local node name, since that behavior
seems clearly buggy and unintentional, and I have difficulty imagining
it is actually being used anywhere. It would be relatively
straightforward to restore if desired, however.

[armon]

This looks good. I agree with all of your reasoning. I can't say I fully get wrapTLSClient but I'm definitely no expert in TLS.

[nelhage]

@armon Thanks! I think these are the tests I wanted, so I'm now happy with this.

wrapTLSclient is mostly copied from http://golang.org/src/pkg/crypto/tls/handshake_client.go#L235 if that makes you feel any better about it.

[armon]

Awesome! Thanks for all your hard work on this!