various TLS bugfixes
    
    - reject non-file keyfiles in TLS_CACERTDIR (#652315)
    - TLS_CACERTDIR precedence over TLS_CACERT (#652304)
    - accept only files in hash.0 format in TLS_CACERTDIR (#650288)
    - improve SSL/TLS trace messages (#652818)
    - add support for multiple prefixed Mozilla NSS database files in TLS_CACERTDIR
    
    Resolves: #652315 #652304 #650288 #652818