- Add ssl cert verification for vpn and okta side, if configured

- new option `vpn_url_cert`
  - new option `okta_url_cert`
- rename client certificate option to `client_cert` from `cert`
- totp: comment out ABCDEFGHIJKLMNOP secrets, default to not set (so you get asked)
- grab and display prelogin errors (for example: client certificate needed or such)
- new option `openconnect_certs` that points to a file to collect all given and collected server certificates, will be given to the final openconnect call (inspired by nicklans fork, thank you). If it is not set it will be a temp file.
- check all redirect and parsed urls if they point to an expected domain (either `okta_url` or `vpn_url`)
- learn `gateway` from getconfig call, if not set/overridden by config file

gp-okta.conf

@@ -1,15 +1,24 @@
 debug = 0
+
 vpn_url = https://vpn.example.com
+#vpn_url_cert = vpn_url.cert
+
 okta_url = https://example.okta.com
+#okta_url_cert = okta_url.cert
+
 username = myuser
 password = mypass
+#client_cert = path-to-myusers-client-cert-as-unencrypted-pem-file.pem
+
 # mfa_order = totp sms
 sms.okta = 0
-totp.okta = ABCDEFGHIJKLMNOP
-totp.google = ABCDEFGHIJKLMNOP
-gateway = Manual ny1-gw.example.com
-#cert = path-to-client-cert-as-unencrypted-pem-file.pem
+#totp.okta = ABCDEFGHIJKLMNOP
+#totp.google = ABCDEFGHIJKLMNOP
+
+gateway = Manual ny1-gw.example.com   # optional hardcoded gateway
+
 #openconnect_cmd = sudo openconnect
+#openconnect_certs = path-to-a-writeable-filename-in-which-the-script-will-collect-all-involved-server-certs-if-not-set-a-temp-file-is-used-instead
 openconnect_args =                    # optional arguments to openconnect
 execute = 0                           # execute openconnect command
 another_dance = 0                     # second round of authentication required