Enable TLS by default and add UI for client/daemon auth

Turns on TLS by default and uses public keys to authenticate access.

- This PR still may require further testing and input on the user experience.
- FSNotify support has not been added to detect changes to authorized_keys
- Implementation of proposal from #7667

@bfirsh please review and comment on whether this is missing anything needed
Agreed although this particular article seems more focused on the means.  Not sure what the difference between this and a userguide would be, I'll let @fredlf chime in for clarity.