Ref T10227. Currently, we have a weird one-off thing in arc for blindly trusting domains, since this was easier than dealing with all the users using self-signed certificates.
Convert this into a modular extension and extend it to support certificates with bad hostnames (maybe plausibly legitimate when connecting to a machine via different interfaces? I guess?) and proxies.
This is the first of three changes which bring support to all of libphutil, arcanist, and Phabricator.