ui: add an instance flag to hold --insecure bit
Currently, when --insecure is used we set web.cacerts=! and
socket validation takes this value into account. web.cacerts=!
is not documented AFAICT and is purely an internal implementation
detail.
Let's be more explicit about what is going on by introducing a
dedicated variable outside of the config values to track that
--insecure is used.