secrets: allow to configure certificate check
    
    Some users may want to use TLS with unverified peer (for example if
    they use self-signed certificate) or if unverified hostname (if
    certificate hostname does not match with the real hostname). On the
    other side it may be useful to point to a directory containing custom
    certificate authorities.
    
    This patch add three new options to secrets responder:
    verify_peer => peer's certificate must be valid
    verify_host => hostnames must match
    capath => path to directory containing CA certs
    cacert => ca certificate
    cert => client certificate
    key => client private key
    
    Resolves:
    https://pagure.io/SSSD/sssd/issue/3192
    
    Reviewed-by: Simo Sorce <simo@redhat.com>
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>