Lumberjack client certificate authentication

Added lumber jack client certificate authentication. Options to specify the CA, optional use of the system CA. Change was so small I didn't do a branch. Corresponding PR for Logstash to follow. 

https://github.com/elasticsearch/logstash/pull/1633
You should never verify client certificates against the Internet PKI root CAs, unless you're also doing identity verification, which you're not.  As it stands, anyone who turns on this option is allowing *anyone* who can get a certificate from *any* widely-trusted CA access to their indexer.