feat(tls): add an option for optional TLS client authentication

[dufkan]

Previously there were only two options for client authentication – either no authentication or mandatory authentication. With this change, a server can allow for optional authentication with a given root CA certificate and enforce client authentication on a per-request basis.

Refs: #687

Motivation

Currently, there is no easy way of performing client authentication on a per-request basis with the API provided by ServerTlsConfig. This behavior is useful in scenarios like the one described in #687, i.e., when some endpoints should be publicly accessible while others not.

Solution

Since rustls provides ClientCertVerifier with the desired behavior, it only needs to be made accessible from ServerTlsConfig. Currently, when the method client_ca_cert is called on a ServerTlsConfig, it forces mandatory client authentication with a given root CA certificate.

I propose to rename this method and change its input to a three-valued enum – no authentication (default), optional authentication with a provided root CA certificate, and mandatory authentication with a provided root CA certificate. I understand this is a breaking change, but it seems like a much cleaner solution than introducing a new method along client_ca_certificate that would set some optional flag in ServerTlsConfig, since the flag would have no meaning if the client_ca_certificate was not used.

[LucioFranco]

I think we can move forward with this change, I left a few comments on the api but otherwise I think this could be a good addition, thanks!