This partially reverts commit 8ecaf5f9.

(proxy, remote acl's) add option to disable cert validation, closes https://github.com/opnsense/core/issues/1271

We don't need the flag anymore, it must be set through primary or
secondary console explicitly.

add validation message

(captive portal) don't try to generate invalid vouchers, closes https://github.com/opnsense/core/issues/1253

Let's keep this simple for now, just don't leave the dialog as long as the input isn't valid yet....

PR: https://forum.opnsense.org/index.php?topic=3972

PR: https://forum.opnsense.org/index.php?topic=3979.0

PR: https://github.com/opnsense/core/issues/1275

PR: https://github.com/opnsense/core/issues/1277

o Mark interface used in case of interface tracking
o Don't inject local DNS server when there is no IP

PR: https://github.com/opnsense/core/issues/1273

This doesn't really matter in the current code as it is the
default and only 'one' makes the implementation change its
scope, but for the sake of consistency let this be fixed.

We're switching to PHP 7.0 (or 7.1 maybe), php-suhosin seems dead,
and maybe someone wants to work on a newer python base.

PR: https://forum.opnsense.org/index.php?topic=3976

Private functions get "_" prefix, easy to spot from elsewhere
if needed.  Yes, someone will try this eventually.  ;)

PR: https://github.com/opnsense/core/issues/1250

Discussed with: @adschellevis

o Respect the 'dnslocalhost' option, which wasn't previously possible
  because dhcpleases clobbered /etc/hosts directly anyway.
o Align the code with how unbound does it: use a private file for
  the hosts generation.
o HUP dnsmasq at the end of the hosts file regeneration.
o `--dhcp-hostsfile' was really really wrong as /etc/hosts is read
  automatically, and the file specified here should have been adhering
  to the dhcp leases format of on `--dhcp-host' argument per line.