Preserve TLS client certificate configuration - #2161

What changed

• read client-certificate flags from the located security.tls configuration
• expose a peer principal when either required or optional client authentication is enabled
• add regression coverage for nested TLS configuration

Root cause

SslConfig located the nested TLS block but read clientCertificateRequired and clientCertificateWanted from the outer endpoint configuration. SSLEndPoint also restricted principal extraction to required authentication only.

Impact

Configured client-certificate modes now reach the SSL engine, and optionally supplied client certificates can contribute the endpoint principal.

Validation

Added a unit test for nested security.tls client-certificate settings.

Dependency

The mandatory-handshake enforcement fix is in the companion authentication_library pull request from the same branch name.