[WIP] Allow keys without available public key to be used for SSL

[dwmw2]

This is the continuation of #1551. This is actually against 1.1.1 not 3.0.0 as discussed, but it's basically the same and testing on 1.1.1 means I don't have to rebuild the whole world including the PKCS#11 engine.

It's a special case for EC for now; we can later extend the generic EVP_PKEY API to have a generic "here's a public key I checked matches this private key; you might want to remember it" method.

But first we need to deal with the fact that X509_check_private_key(), where we want to do this thing, now takes a 'const' private key, so it's not clear if we should be doing anything of that form at all.

From my notes in #1551;

crypto/x509/x509_cmp.c: In function 'check_key_signature':
crypto/x509/x509_cmp.c:280:42: warning: passing argument 1 of 'EVP_PKEY_CTX_new' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
     EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(priv, NULL);
                                          ^~~~
In file included from include/openssl/x509.h:18:0,
                 from crypto/x509/x509_cmp.c:14:
include/openssl/evp.h:1338:15: note: expected 'EVP_PKEY * {aka struct evp_pkey_st *}' but argument is of type 'const EVP_PKEY * {aka const struct evp_pkey_st *}'
 EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e);
               ^~~~~~~~~~~~~~~~
crypto/x509/x509_cmp.c:304:28: warning: passing argument 1 of 'EVP_PKEY_CTX_new' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
     ctx = EVP_PKEY_CTX_new(pub, NULL);
                            ^~~
In file included from include/openssl/x509.h:18:0,
                 from crypto/x509/x509_cmp.c:14:
include/openssl/evp.h:1338:15: note: expected 'EVP_PKEY * {aka struct evp_pkey_st *}' but argument is of type 'const EVP_PKEY * {aka const struct evp_pkey_st *}'
 EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e);
               ^~~~~~~~~~~~~~~~

The correct way to fix that is not obvious. Is the first argument to EVP_PKEY_CTX_new() really not const? Casting to non-const seems wrong, and that's just for the first part. When we later come to copy the public key data, it gets even wronger...

[levitte]

I believe that the sane thing is to consider making it a separate public functions, something like X509_check_signature, to be called separately fromin conjunction with, or maybe even instead of X509_check_private_key.

While you're at it, I suggest also adding X509_REQ_check_private_keyX509_REQ_check_signature, for API consistency.