This introduces Certificate.matches_host(), which takes a hostname or

IPv4/IPv6 address and matches it against the Subject and SAN values

stored in the certificate. This supports hostnames, IPv4 addresses, and

IPv6 addresses.
matches_host() starts by determining if this is an IP address or a

hostname, and then performs only the checks needed for that type.
For IP checks, comparisons between instances are performed.
For hostname checks, matches_host() wraps a new utility function,

get_cert_hostname_matches(), which can be used without a Certificate

instance. This supports bare hostnames, hostnames with multiple labels,

and wildcard patterns.
Wildcard matching takes care to only match the first label in a hostname

(such as *.example.com) and to avoid matching bare hostnames. It does

not support partial wildcards, such as foo*, *bar, or foo*bar, as

these are largely unsupported by browsers, servers, and Certificate

Authorities these days (Chrome treats them as a security issue).
Certificate.subject_alternative_names has been updated to return

ipaddress.* instances for IP address/network values and strings for

hostnames. This allows match_host() (and other callers) to handle each

entry correctly.

Unit tests pass.