Encapsulated configs

Encapsulated configuration, ready for real validation.

It's a little awkward, but in the end `Tls.Config.server` and `Tls.Config.client` beat ah-hoc `o_server` and `o_client` all over the place.....