[http] mtls, authzn overhaul

[http] mtls, authzn overhaul

- authorizer route actions are replaced with a separate interface
- add support for mTLS server identities and client cert validation
- add client cert authorizer with fine grained control over SPIFFE domains, users & services
- fully support hot reload for TLS using hotSwappableTLSConfig
- add HTTPError struct type (implements error) to wrap http errors
- support tls config at both listener- and vhost-level

supporting changes:

- mtls: open up interface to allow checking subjects separately from cert validity
- mtls: add `VerifyYamlConfig` type for reusable partials
- mtls: add certObject primitive (public interface: `SwappableCert`) for concurrency-safe, guaranteed consistent access to cert object types that can briefly be inconsistent in underlying storage (e.g. filesystem)
- mtls/certutil: add SplitChain, SplitChainRoot, and IsSelfSigned functions
- mtls: cleanup deprecated IdentityDriver types
- mtls: add `CertificateNotifyOnReload` interface for cert types that can perform watch-/monitor-based reloads

known limitations:

- MTLSPeerVerifier really does not

incompatible config change: `auth` route property changes from string to []string

**🚫🤖 No AI**