libfetch: allow to optionally verify CRL with SSL_CRL_OPTIONAL

[franco_opnsense.org]

Summary

This works with both SSL_CRL_FILE and SSL_CRL_VERIFY. In the abensence
of a CRL distribution point OpenSSL by default assumes that a CRL does
exist anyway and will fail to validate when not given by the user.

This can be problematic when it is unclear which host is going to be
connected and how the chain is constructed. In edge cases this ensures
CRLs to be checked as they are (or are not) publicly distributed.

Also see: https://openssl-users.openssl.narkive.com/qKrxQx5U/certificate-crls-x509-v-err-unable-to-get-crl