Configurable fallback to unauthenticated TLS

Since the primary purpose of fallback levels is to allow policy
degradation with an audit trail, add configurable tls audit logging,
which allows policy lookup errors to be logged synchronously, and
the fact of the fallback is then recorded in the audit entry.
Comment nit