Add identity-based TLS auth and UI for client/daemon auth

Turns on TLS by default and uses public keys to authenticate access.

- This PR still may require further testing and input on the user experience.
- FSNotify support has not been added to detect changes to authorized_keys
- Implementation of proposal from #7667

@bfirsh please review and comment on whether this is missing anything needed
To be clear: It doesn't make sense to have an envvar called `DOCKER_TLS_VERIFY` when the corresponding command line option doesn't exist any longer.

I think we should also have corresponding environment variables for `DOCKER_AUTH_CERT`, `DOCKER_AUTH_CA`, etc. The `DOCKER_CERT_PATH` envvar is fragile in scary, insecure ways when the files that it looks for don't exist.