Start cleaning up X509_STORE_get1_issuer()

Start cleaning up X509_STORE_get1_issuer()

Get rid of the last X509_OBJECT_free_contents() call by moving the object
from the stack to the heap. I deliberately kept the obj variable to keep
obj and pobj separate.  Rename the out parameter from issuer to out_issuer
to ensure that we only assign it when we have acquired a reference that we
can return. Add a new X509 *issuer. In the first part of the function,
acquire an extra reference before check_issuer/check_time.

In the second part of the function, acquire a reference inside the lock to
avoid a race.  Deal with ret only in one place.

ok jsing