Add identity-based TLS auth and UI for client/daemon auth

Turns on TLS by default and uses public keys to authenticate access.

- This PR still may require further testing and input on the user experience.
- FSNotify support has not been added to detect changes to authorized_keys
- Implementation of proposal from #7667

@bfirsh please review and comment on whether this is missing anything needed
Given the `docker hosts` and other cluster Docker setups we're seeing, I'd just drop 'defaults' and re-write to something like

```
Docker can communicate locally using a unix socket or systemd socket (or whatever that thing's called), or, can communicate using a HTTP socket.
```