Allow verification of signatures before sending

[lrstewart]

Description of changes:

Add a new API that turns on signature verification.

We already have a similar API, s2n_config_set_async_pkey_validation_mode, which only applies to signatures that use the async pkey operations. The verification is more useful for async operations because it can help detect the case where the operation is performed with the wrong key.

This new API applies to all signatures, both sync and async.

Call-outs:

• We could deprecate s2n_config_set_async_pkey_validation_mode. However, it's not actually worse than the new API, just more narrowly focused.
  • Alternatively, we could just expand the scope of s2n_config_set_async_pkey_validation_mode to include sync signatures instead of adding a new API. Since you can actually use the async pkey callbacks to do pkey operations synchronously, it wouldn't really be a massive departure. But the the name would still be very deceptive.

Testing:

Test cases:

• Async signing, valid signature: covered
• Async signing, invalid signature: covered
• Sync signing, valid signature: covered
• Sync signing, invalid signature: NOT COVERED. I'm not sure how to test this with a unit or integ test, since it's not actually possible without libcrypto bugs or hardware issues.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.