Add client certificate authentication and optional SASL EXTERNAL bind,

Add client certificate authentication and optional SASL EXTERNAL bind,
which allows the client to bind as the subject of the certificate in cases
where the directory doesn't implicitly do that.

The client certificate is configured with 'certfile' and 'keyfile'
directives, and SASL EXTERNAL bind is configured with the 'bindext'
directive.

ok tb@