fix(errors): say when the server's certificate is the problem

[fullynocturnal]

A TLS failure is an IOException, so it was reported as "Network error, check your connection". Someone whose server uses a private CA, a certificate for another name, or an expired one would go off to debug their network when the answer was on the server.

Release builds now name the three certificate cases:

• Not trusted. Says so, and that certificates installed on the device are not used. That is the obvious next question from anyone who installed their own CA and wonders why it made no difference.
• Issued for another address. The classic case: entering a server by IP when its certificate names a hostname.
• Expired or not yet valid. Points at the device clock as well as the certificate, since a wrong clock produces the same error.

The check reads the handshake exception's cause chain and only uses a certificate message when a certificate really is the cause. A handshake that fails for another reason, such as the server dropping the connection, keeps the network message. None of this shows on debug builds, which accept any certificate.

This changes wording only. What the app trusts is exactly what it was.

Checked

• Unit tests for each case, shaped like what Android throws (the validator's verdict wrapped a level or two down), plus one holding that a non-certificate handshake failure still reads as a network error.
• Full unit suite and assembleOpenDebug on this branch.