implement the VerifyPeerCertificate mint.Config option

[marten-seemann]

Depends on #170. Replaces #163.

This PR replaces the Config.AuthCertificate with a Config.VerifyPeerCertificate. The purpose of both methods is similar (although AuthCertificate never actually worked). VerifyPeerCertificate is supposed to work exactly like the tls.Config.VerifyPeerCertificate in the standard library.

Note that currently for the server, the verifiedChains argument for VerifyPeerCertificate is always nil. This is consistent with the way we implement client auth (by just requiring the client so send any certificate), which is one of the ways the Go standard library allows client certificate verification. I created #171 to track this, and I'll be happy to contribute some code to resolve this issue in the future.

The code was taken from the Go standard library:

• for the client: https://golang.org/src/crypto/tls/handshake_client.go#L307
• for the server: https://golang.org/src/crypto/tls/handshake_server.go#L740