[BP 7.2.0] Improve server certificate validation (validate SAN)

Currently ns_server doesn't validate the SAN extensions when server certificate is being uploaded. This allows users to upload certificates that have SANs that don't match the node name, which later leads to misunderstanding when customers are trying to turn on encryption or to add new nodes. Ideally we should not let users to upload that kind of certificates.

Note that implementation is not that obvious because certificates can be uploaded before node initialization, when node name can still be changed. This scenario needs to be taken care of.

This validation should be turned on by default, but should be configurable (so there should be at least a diag/eval to turn it off).