Support certificate validation callback

[ctz]

At the moment if SSL_CTX_set_verify is called with a non-NULL callback, we return an error. Instead, we should implement this. That will mean filling in an X509_STORE_CTX.

This should unlock nginx support for client authentication.

[cpu]

I bumped into this while implementing support for SSL_CONF_cmd(..., "VerifyMode", ...) where I was hoping to make an Nginx based integration test using ssl_conf_command VerifyMode ... for setting client auth as requested or required. Leaving a note here that when this is resolved we should add that integration test.