Is not uncommon for the systray to be launched without internet access.
For example in the autostart if the network hasn't come up yet.

Let's fetch the vpn cert when the vpn is starting, instead of in the
initialization of the standalone bitmask. So if the initialization
happens when there is no network the systray doesn't fail to start.

- Resolves: #88

The linux version of the notifications library we are using doesn't
handle the gtk.main loop. It requires the systray to be running to be
able to display a notification.

Spliting the start of the systray and the loop we can start the systray
pretty early and later on launch the main loop once we have bitmask and
other stuff ready.

- Related: #88

we try to use the geoip service, and if the answer has an entry for the
sorted gateways, we just use it instead of using the timezone heuristic.

- Resolves: #84

Get local timezone and http client as configurable things in bonafide,
so tests can set them. Also separate integration tests and unit tests.

We can do just with two buttons and changing the names.