certstore: re-factor peer certificate authorization routine

* cleanup CertStore to remove unused features
* ensure that at least one certificate in the chain is allowed
  if public calls are disabled and that no certificate in the chain
  is banned, additionally to the chain match.
  This prevent allowing any certificate signed by the CA of a contact,
  while still supporting authorization through a CA (with
  setCertificateStatus).
* use dht::crypto::TrustList when relevant (requires OpenDHT bump)
* rebuild trust list when appropriate as GnuTLS' trust list
  doesn't allow "unbanning". This fix issues when banning then allowing
  a certificate during the same session

Change-Id: I8ea28f3a673eebf2174e8fab3a413c20630b28ca
Reviewed-by: Nicolas Jäger <nicolas.jager@savoirfairelinux.com>