Add documentation regarding collecting invalid certs

[glinton]

Resolves #6066

I wonder if a better solution would be to always enable insecure_skip_verify. The tests set it by default.

[danielnelson]

The one thing having insecure_skip_verify = false does for us now is give some sort of indication if the certificate is invalid. Unfortunately it's not a positive claim, the metric just stops being emitted.

Originally we wanted to report if the cert was valid but we removed it because our check could report valid for some invalid certs. If we research the right arguments to x509.Verify( I think we could potentially add validity information and remove this option.

One more thing, I notice that even with insecure_skip_verify = true you can't get a self signed certificate over HTTP (assuming you don't have the CA cert for it).

[glinton]

Preferring 6143 over this