tls: separate out cert validation logic from ContextImpl

[mathetake]

The first step towards #14614. Ref #14614 (comment)

Note that the change is almost moving codes from context_impl to cert_validator/** with a bit of necessary tweaks.

Commit Message: tls: separate out cert validation logic from ContextImpl
Additional Description: In order to create the extension point for certificate validation, separated out the cert validation logics from Tls::ContextImpl, and move them to Tls::DefaultCertValidator which implements Tls::CertValidator interface. Ref: #14614 and #9284
Risk Level: low (almost code moves)
Testing: unittest
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Deprecated:]

cc @lizan

[lizan]

Overall this looks good, the coverage is missing from some error config part:
https://storage.googleapis.com/envoy-pr/7004480/coverage/source/extensions/transport_sockets/tls/cert_validator/default_validator.cc.gcov.html

were them covered before?

[mathetake]

looks like they haven't been covered before as well :https://storage.googleapis.com/envoy-pr/e1ca2ab/coverage/source/extensions/transport_sockets/tls/context_impl.cc.gcov.html

but some of them are formatted into multiple lines in this PR plus the file size becomes smaller so I think that is why the coverage goes down in terms of the number of lines covered 😕

[mathetake]

/retest

[repokitteh-read-only]

Retrying Azure Pipelines:
Retried failed jobs in: envoy-presubmit

🐱

Caused by: a #14757 (comment) was created by @mathetake.

see: more, trace.

[mathetake]

@lizan added the coverage exception. PTAL

[lizan]

@ggreenway for non-tetrands review

[ggreenway]

LGTM