RFE: st2client should verify ssl certs by default

When using the st2client remotely, It does not verify ssl certs by default, thus causing warnings like:

InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
  InsecureRequestWarning)

This has been reported before in #1923 which was resolved with #2014 (adding a config option ssl_silence_warnings). In that case, the cert was a self-signed cert, so whatever solution is added to verify certs by default should deal with the self-signed cert which is added by default to many/most stackstorm installs.

So, the way things are currently, that leaves two options for removing those warning:

• ssl_silence_warnings = true
• cacert = <path to a ca certificate file>

For linux, that file could be /etc/ssl/certs/ca-certificates.crt, but the setting a default on other systems is "difficult" (see this stackoverflow question linked to from the urllib3 docs)

The urlib3 docs also suggest an alternative default: use certifi.

When cacert is not defined in the config file, could we default to cacert = certifi.where()? How would that play with self-signed certs?

When running the CLI on the same host as the ST2 server, the cert validation isn't much of an issue because it skips nginx by default and just talks with the api, auth, and stream ports directly. So, for most default users, I would guess they are using the CLI on that server instead of installing st2client for remote access. So, using certifi by default would apply in cases where st2client is running remotely, in which case, expecting a valid ssl cert by default sounds reasonable.

To support cases where someone wants to run st2client remotely with a self-signed cert, I suggest we make it possible for them to opt-out of the secure-by-default setting and either set cacert = None, or set something like ssl_no_verify = true.

So, to sum up, I'm requesting:

1. cacert = certifi.where() by default.
2. Allow disabling ssl verification (and, probably, the warnings too) for remote st2client users talking with a server using self-signed certs.
3. If a user wants to set some other cacert, they can still do so (including to 'validate' their own self-signed cert)

Start by tracing st2client’s configuration and HTTPS request setup, focusing on the existing cacert and ssl_silence_warnings options. Use the three requested cases as acceptance criteria: a certifi default, a user-supplied CA, and an explicit opt-out for self-signed certificates.