r8549

PKIX factory bean that supports anchors, CRLs, and a verify depth setting. The rest is just defaulted with dynamic name extraction turned on, which fits the code path of the HTTP client, so it defaults to verifying against the hostname.

Tested with both end entity and a CA cert as the trust anchor.

r8530

First case handled, a bean for ExplicitKeyTrustEngine on top of a StaticCredentialResolver on top of any number of key and certificate resources.

I might need to do an additional layer of indirection on this for HttpClientSecurityParameters but even without that it's a big improvement.