api: fall back to using public cert on cert error

[rogpeppe]

If we get a certificate error trying to connect to a controller,
then it's possible that we're using the private CA but
the address we're connecting to is a proxy that doesn't
have a private CA certificate. In this case, try
again with the public CA.

To test this properly, some refactoring was required. A brief overview:

• separate concerns between internal and external dial parameters by creating
  an internal dialOpts type rather than having unexported fields in the otherwise-public
  DialOpts type.
• add a Clock to DialOpts so that we can fake the clock logic used by Open.
• make DialWebsocket return an interface so that we can easily return a fake connection in tests.
• add jsoncodec.NewWebsocketConn to make that possible.

QA do a model migration to a controller with a frontend proxy.

[mhilton]

LGTM

[rogpeppe]

!!build!!

[axw]

io.Closer

[rogpeppe]

fixed.

[rogpeppe]

$$merge$$

[jujubot]

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju

[jujubot]

Build failed: Tests failed
build url: http://juju-ci.vapour.ws:8080/job/github-merge-juju/10915

[rogpeppe]

$$merge$$

[jujubot]

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju

[rogpeppe]

$$merge$$

[jujubot]

Build failed: Tests failed
build url: http://juju-ci.vapour.ws:8080/job/github-merge-juju/10916

[rogpeppe]

$$merge$$

[jujubot]

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju