... adding a fancy is_success predicate to the arguments of
random_first_with_allowed_failure_ratio, woo.

Contrary to what's documented, the code previously fetched the content of the
URL.

Three pools are used: --pal_pool, --neutral_pool, --foe_pool.

Per-pool:
  - one random server is tried until success
  - first successful result is used
  - a maximum failure ratio before giving up can be passed
    with --allowed_per_pool_failure_ratio

The median of the per-pool results is used.

This will ease future implementation of pal / neutral / foe pools.

Otherwise htpdate will not "succeed" when the time diff is 0 (i.e.
the clock was already correct) so the success file cannot be used
as an indicator that the system time now is correct, which arguably
is its most important purpose.

This eases post-processing parsing of our logs by external tools by providing
them means to find the last htpdate invocation's log.

When a given certificate cannot be verified, the servers pool
consistency is not considered to be secure enough, and the
client exits without setting time.