Avoid SHA1 weakness

In X509_cmp, if cert digest is equal, look at DER of the
signed part.  This is what master and 1.0.2 already do.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>