OpenSSL 1.1.1 cert verification port

[kares]

an attempt to port over verify_chain (build_chain) and all related bits from OpenSSL 1.1.1.

JOSSL current certificate verification algorithm is rather straightforward and dates back to OpenSSL 0.9 days.

Several times we tried porting over newer code to enhance verification (e.g. to consider alternate chains) but failed due the magnitude of the task.

The PR is an attempt for a minimal viable product in terms of OpenSSL 1.1.1 compatible chain verification.
No relevant security features should be missing - if so than they are likely not present in the legacy algorithm as well.

The WiP here skips dane support completely (as well as a few other parts) - full port is far from complete.
There's also a number of (OpenSSL 1.1.1) features which are slightly changed or disabled :

• EXFLAG_SS isn't working - switched cert_self_signed to only check EXFLAG_SI
  • this what legacy does to check self-signed - acceptable for now
  • should be investigated why tighter checks aren't working for JOSSL
  • unify/refactor EXFLAG_XXX checks to do less work?
• drop duplicate check_chain_extension
  • check if OpenSSL still works with ENV['OPENSSL_ALLOW_PROXY_CERTS']
• check_cert checking not ported - using old legacy checks
• OpenSSL 1.1.1 check_crl differences - not passing when enabled
  • support/implement current_crl_score and current_reasons ?
• review/implement auth_level checks
• review/implement check_id