adopt new Twisted TLS APIs

[glyph]

The code in Synapse uses a subclass of ssl.ContextFactory with some manual OpenSSL setup.

Twisted will do quite a lot of this for you (more every day!) and can handle several things that it looks like Synapse isn't doing right now, like service identity validation and sending server name indication.

The relevant APIs are:

• Implement twisted.internet.interfaces.IOpenSSLClientConnectionCreator or twisted.internet.interfaces.IOpenSSLServerConnectionCreator rather than subclassing ContextFactory if you need to do your own thing.
• Consider using optionsForClientTLS for clients, or CertificateOptions (sorry - horrible class name there, I know) for servers, if the default behavior is good enough.

[krombel]

FTR: This would also make it easy to implement http2-connections - e.g. server2server

[richvdh]

We've updated the client side now, but still subclass ContextFactory for Server-side connections.