wicket: Add additional cert validation

[jgallagher]

When uploading cert/key pairs to wicket in preparation for running RSS, we do some basic validation that the key matches the cert, but do not validate:

• that the cert is valid for the DNS name we expect to have
• that the cert is the right kind of cert (which might be covered by the previous check?)

Validation functions to support these should be added to CertificateValidator, and wicket should use them once added.

[iliana]

Did #4100 fix this?

[jgallagher]

It did! (Well, technically #4086 was the wicket one, and #4100 added the same checks to Nexus.) Thank you.