Enable TLS by default and add UI for client/daemon auth

Turns on TLS by default and uses public keys to authenticate access.

- This PR still may require further testing and input on the user experience.
- FSNotify support has not been added to detect changes to authorized_keys
- Implementation of proposal from #7667

@bfirsh please review and comment on whether this is missing anything needed
I think you might be right about calling it "identity" based.  What is not touched in this article (because its probably not the right place) is that the identity is also what would be used for build signature and what is registered via login to tie a hub user to that public key.  It is probably more analogous to identity such as a PGP key than a host login key just for SSH.