feat: add mTLS support for secure client-server communication (#3172)

[zs-gabor]

Kérlek ellenőrizd és ha kell javíts a szövegen, amit a Description mezőbe írtam:

📝 Description

This PR implements mutual TLS (mTLS) support to enhance security for communication channels within CrowdSec, addressing the feature request in #3172. 

With these changes, clients and servers can now authenticate each other using X.509 certificates, ensuring both encryption and mutual identity verification.

✨ Changes Introduced

• Configuration Updates:
    * Added configuration options for CA certificate (ca_cert_file), enable TLS authentication (tls_auth) .

• Core Functionality:
    * In case of TLS auth, checking the existence of the necessary certificates in the "UnmarshalConfig" function.
    * I have highlighted the HTTP server settings in a new function "configureHTTPServer" so that the unit test is easier to check for mTLS.
    * In the "appsecHandler" in case of TLS authentication, the apiKey check has been excluded.

• Testing:
    * Added unit/integration tests for mTLS handshake success and failure scenarios (e.g., trusted and untrusted client cert).

🔗 Related Issue

Fixes #3172

🧪 How to Test

1. Generate Certificates:
      Generate a test CA, server certificate, and client certificates using renew-test-certs.sh (I took the script from the http module and expanded it).

2. Update Configuration:
      Enable mTLS in your configuration file (acquis.d/appsec.yaml):

tls_auth: true
ca_cert_file: /etc/crowdsec/ssl/ca.crt
cert_file: /etc/crowdsec/ssl/server.crt
key_file: /etc/crowdsec/ssl/server.key

3. Verify Connection:

• Valid Client Cert: Connection should succeed.
• Invalid / Missing Client Cert: Connection should be rejected with a TLS handshake error.

---

✅ Checklist

• Code follows project style guidelines
• Tests added/updated and passing
• Verified backwards compatibility when mTLS is disabled

[github-actions]

@zs-gabor: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.

• /kind feature
• /kind enhancement
• /kind refactoring
• /kind fix
• /kind chore
• /kind dependencies

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[github-actions]

@zs-gabor: There are no area labels on this PR. You can add as many areas as you see fit.

• /area agent
• /area local-api
• /area cscli
• /area appsec
• /area security
• /area configuration

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[zs-gabor]

/kind feature

/area appsec
/area configuration