Certs: Re-ask for different cert after rejection #4898 (#4911)

Certs: Re-ask for different cert after rejection #4898 (#4911)

Previously rejecting any kind of certificate meant that the user
was never asked again, even if the certificate changed.

Now we keep track of which certificates were rejected and ask again
if the ones mentioned in the ssl errors change.

mitmproxy is excellent for testing this.