fixes #7822 - forbid HTTPS requests with no client SSL certificate

Please review as a priority, and test heavily.  It seems that OpenSSL correctly refuses connections when the certificate presented isn't trusted by the CA that the server is using (note, we don't have separate client/server CAs), and the problem is only when no client cert is presented.

I can't see a way to check that relying on OpenSSL for bad verification is always solid.  The closest I've found is that the socket that WEBrick sees has an OpenSSL verification result attached (http://ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL/SSL/SSLSocket.html) but I can't see a way to get at that.  In any case, it only seems to reach the smart proxy when there's either no cert or it validates and in both cases the verify_result was "OK".

Lastly, I'm looking at more tests in the 7822-ssl-verify branch which test Proxy::Launcher's https_app by spinning up the rack/WEBrick app and then make requests, but this will take more refactoring.  I will probably follow up with this in another ticket, and only to develop (not 1.6 etc).

No CVE assigned yet - will add it to commit message before it's merged.
How do you think it should be implemented?  I don't see how to add a filter globally, without either modifying Sinatra::Base (which I'm a little wary of, as they warn against it), and creating a base class for all API impls.