otptoken: use ipapython.nsslib instead of Python's ssl module
    
    The otptoken plugin is the only module in FreeIPA that uses Python's ssl
    module instead of NSS. The patch replaces ssl with NSSConnection. It
    uses the default NSS database to lookup trust anchors. NSSConnection
    uses NSS for hostname matching. The package
    python-backports-ssl_match_hostname is no longer required.
    
    https://fedorahosted.org/freeipa/ticket/5068
    
    Reviewed-By: Martin Basti <mbasti@redhat.com>