Port ssl3_get_cert_verify to CBS.

Also tidy up a little now that {RSA,ECDSA}_verify don't have two separate error
codes.

Change-Id: Id0e9248f63766771032a131fd96d86d2596ade32
Reviewed-on: https://boringssl-review.googlesource.com/1168
Reviewed-by: Adam Langley <agl@google.com>