MINOR: ssl/ocsp: use 'ocsp-update' in crt-store

MINOR: ssl/ocsp: use 'ocsp-update' in crt-store

Use the ocsp-update keyword in the crt-store section. This is not used
as an exception in the crtlist code anymore.

This patch introduces the "ocsp_update_mode" variable in the ckch_conf
structure.

The SSL_SOCK_OCSP_UPDATE_* enum was changed to a define to match the
ckch_conf on/off parser so we can have off to -1.