Callback to Verify x5Chains

[ben-krieger]

TO2 verifies the public key of the x5chain using the leaf certificate in the same way as with x509-encoded public keys. This ignores all other contents of the leaf certificate as well as the rest of the chain.

TO2Config should contain a callback similar in style to (*tls.Config).VerifyPeerCertificate that allows TO2 to fail if any chains are untrusted. There should also probably be a simpler configuration for the most common convention - such as verifying all chains with a single https://pkg.go.dev/crypto/x509#VerifyOptions.