Support TLS `ca` and `rejectUnauthorized` options (connect to self-signed servers)

[natevw]

This improves the TLS module's node.js compatibility regarding (remote) server certificate handling (i.e. when Tessel is the client).

• support {rejectUnauthorized:false} option, aka enable cheap MITM attacks [useful for development and careless people]
• support custom CA lists [useful for validating self-signed certs or own set of trusted roots]
• tlsSocket.getPeerCertificate() is now sort of implemented for non-detailed info (even that is probably not 100% compatible with whatever undocumented fields node.js provides, but presumedly better than nuffins)
• also fixed a bug where a server certificate that didn't contain subjectaltnames would always be rejected

[tcr]

This patch lgtm, after some minor comments. Can we get a test case for this?

[natevw]

Updated the patch based on feedback.

Agree that tests would be great (right now TLS test "suite" connects to google.com:443 once and calls that roses). Do you know of any TLS-related test server hosts? Ideally we'd test many different types of invalid certs (self-signed/untrusted root, mismatched host, expired, etc.) to make sure they fail, and then for the self-signed case provide the ca and make sure it passes.

[natevw]

Just struck me that as soon as we get the proxy server up publicly, assuming we leave it self-signed, it would be an ideal candidate for at least a bit more thorough tests:

• make sure a default connection errors due to cert
• verify that we can connect in "MITM mode" (rejectUnauthorized:false)
• verify that we can connect when the custom CA is provided

[tm-rampart]

Approved by @natevw. Running tests.

[tm-rampart]

Merge or tests failed.

[tm-rampart]

Approved by @natevw. Running tests.