OpenSSL: Leaf certificate time validity check when no CA is configured

OpenSSL: Leaf certificate time validity check when no CA is configured

When ca_cert_verify=0 (CA is not configured) the callback overrides all
OpenSSL errors, including time validity. Add an explicit leaf (depth 0)
check and do not override X509_V_ERR_CERT_HAS_EXPIRED/NOT_YET_VALID,
unless TLS_CONN_DISABLE_TIME_CHECKS is set.

This preserves the existing behavior of ignoring chain/issuer errors in
no-CA mode; pinning/CRL/OCSP/name checks are unchanged.

Signed-off-by: Rathan Appana <rathanappana@gmail.com>