iOS and tvOS have no SSL CA chain #29

_hx_ssl_cert_load_defaults returns nothing on iOS and tvOS, so TLS verification fails there (upstream HaxeFoundation/hxcpp#570).

Upstream PR: HaxeFoundation/hxcpp#1331. Before taking it: the verify callback clears every flag on a trusted leaf, including the hostname mismatch, and the SecPolicy has no hostname, so any OS-trusted certificate is accepted for any host. Also check the SecTrust results, pass the intermediates, and mind that SecTrustEvaluateWithError needs iOS 12.