Stop using insecure option by default

[SamMousa]

Issue Summary

...
CURLOPT_SSL_VERIFYPEER => false
...

Steps to Reproduce

1. Install the library.
2. Use it.
3. Get a MITM attacker
4. Don't notice it because we're not validating SSL certificates

Technical details:

• php-http-client Version: master
• PHP Version: 7.1

Why would you disable SSL peer verification by default in a library??
At the very least people incapable of configuring their servers decently should disable security options manually. Current it's the other way around and only people randomly inspecting source code notice that you're disabling SSL security features by default...

[thinkingserious]

Thanks for catching this @SamMousa!

I've added this to our backlog for a fix.

To those who would like to make a PR, the fix would happen here.

With Best Regards,

Elmer