Add an option to disable server certificate validation on the client

We've had several independent requests (and a PR or two) to re-add support for the "-n" option, which disables tlshd's server certificate validation checking when it runs on the client. Checking would be disabled only for "encryption-only" mode -- for mtls, both peers would continue to validate the other's certificate.

The argument is that it makes code development easier, or that it simplifies deployment. When debugging or developing code, it should be simple enough to use self-signed certificates, and distribute an appropriate CA bundle for these certificates. We don't feel this is a compelling use case at this time.

The main use case, then, would be the desire to make the deployment of clients that need only encryption completely free from the problems of distributing certificate material. Currently one can do this only when the server's certificate has been signed by a well-known certificate authority that is likely to already be present on clients.

Notably, however, without server certificate validation, a man-in-the-middle can pretend to be a server and thus intercept TLS sessions from a client. This renders encryption rather pointless.

I'm opening this issue to continue the discussion: Does deployment convenience outweigh strong security? Conversely, is there a secure way to deliver a configuration setting that makes client set-up simpler? Comment below.

The issue names tlshd and the proposed -n option but no files, tests, or entry points. Start by reviewing the client certificate-validation path and option parsing, then confirm whether the project has decided to pursue the change; done would require an agreed secure behavior and corresponding coverage.