BuildSSLContextFromSSLCertTests stubbed out OpenerDirector.open, so the

urlopen handler chain never ran and https_open() was never reached. The

tests then asserted against the SSL context the handler was constructed with,

which is not necessarily the one the request uses.
That hid a real bug. The legacy ssl_cert fallback context was being

discarded in https_open(), and all three legacy tests passed anyway.
These tests now stub do_open() on the handler instead. The chain runs as far

as opening a connection, and the assertions look at the context handed to the

connection, which is the one that would reach the server. Each call to

ssl.create_default_context() gets its own CaptureSSLContext so that a

rebuilt context doesn't accumulate state from the one it replaced.

Reverted the https_open() fix and confirmed

test_open_with_legacy_ssl_cert_hostname_mismatch failed, where before it

  passed against the same bug.
Ran unit tests for reviewboard.certs and reviewboard.hostingsvcs.