limbo: remove old ee_cert helper, SAN everywhere by default

[woodruffw]

This removes the old ee_cert helper entirely, replacing it with Builder.leaf_cert.

As part of that, our default generation behavior is now to include SAN(dns="example.com") by default. This should make it easier to integrate the test suite.

Needs a semi-fine-toothed review, since this was mostly machine refactoring.

[tetsuo-cpp]

LGTM. I'll run this against my the pyca/cryptography branch and check that there aren't any unexpected failures.

[tetsuo-cpp]

Oh, the other missing piece to this is that we need to call expected_peer_name on the Builder everywhere. I think the most practical way to do this is to make example.com the default value.

I've pushed 8c9183f to deal with that. The tests run fine with this change. Feel free to revert if you had other ideas.

[woodruffw]

Oh, the other missing piece to this is that we need to call expected_peer_name on the Builder everywhere. I think the most practical way to do this is to make example.com the default value.

Yeah, that makes sense to me, now that we're setting the SAN to a default of example.com.