(#20027) Fix ssl_client_ca_auth validation

Without this patch applied the `ssl_client_ca_auth` setting does not
cause the behavior documented with the option.

The expected behavior is that the agent should refuse to connect to a
Puppet master which presents a SSL certificate whose chain does not
include a certificate listed in the `ssl_client_ca_auth`.

This patch addresses the problem by scanning through the peer
certificate chain, checking each certificate in the chain against the
set of certificates listed in the `ssl_client_ca_auth` file.  If this
setting is not configured then the `localcacert` file is used instead,
which should be the root, self signed certificate in default
configurations.
Refactor connection verify_callback
WIP fix up spec tests