Add support for self-signed root certificates

Using self-signed certificates is currently impossible (the only alternative is to completely disable TLS, which is not an option for any serious use case).

This MR introduces a new enum variant, SelfSigned, which configures the underlying reqwest client with the appropriate root certificate(s).