Hostname verification on by default

[scottf]

Flips the default of the hostname verification added in #1638: the certificate the server presents must be issued for the server name the connection was made with, unless the user turns the check off.

• Hostname verification is on by default for every TLS connection, including opentls and a hand-supplied trust-all context. tlsVerifyHostname(false) on the builder, or the io.nats.client.tls.verify.hostname=false property, turns it off.
• Options.Builder.tlsVerifyHostname(), unreleased, is replaced by tlsVerifyHostname(boolean).
• A connection to a server whose certificate does not name the host in the url now fails with a CertificateException naming the expected host. Reissue the certificate for the name, use the name the certificate carries in the url, or turn the check off.
• README: paragraph in Connection Security, row for the property in the properties table.
• docs/TLS_CONFIGURATION.md: new section 4 on what is checked, under which contexts, and how to fix a failure; the trust-all section no longer says the hostname is never checked.
• ReconnectTests: the three tests that use the certificate without an ip subject alternative name connected by 127.0.0.1, which the default now rejects. The tls scheme test and the two-server cluster test connect by localhost, the name the certificate carries; in the cluster test the reconnect to the gossiped ip is verified against that name. The opentls test keeps the ip and turns the check off.
• Tests: OptionsTests covers the default, the opt-out, the copy constructor and the property. TlsHostnameTests runs the verifying cases on the default, the accepted-when-off cases with tlsVerifyHostname(false), and the discovered-ip reconnect with verification on by default plus an opt-out variant that shows SNI alone carries the hostname.