CLEANUP: ssl: make ssl_sock_load_ckchs() return a set of ERR_*

CLEANUP: ssl: make ssl_sock_load_ckchs() return a set of ERR_*

ssl_sock_load_ckchs() used to return 0 or >0 to indicate success or
failure even though this was not documented. Make it return a set of
ERR_* instead so that its callers can transparently report its status.
Given that its callers only used to know about ERR_ALERT | ERR_FATAL,
this is the only code returned for now. And a comment was added.