fixes #7822 - forbid HTTPS requests with no client SSL certificate

Please review as a priority, and test heavily.  It seems that OpenSSL correctly refuses connections when the certificate presented isn't trusted by the CA that the server is using (note, we don't have separate client/server CAs), and the problem is only when no client cert is presented.

I can't see a way to check that relying on OpenSSL for bad verification is always solid.  The closest I've found is that the socket that WEBrick sees has an OpenSSL verification result attached (http://ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL/SSL/SSLSocket.html) but I can't see a way to get at that.  In any case, it only seems to reach the smart proxy when there's either no cert or it validates and in both cases the verify_result was "OK".

Lastly, I'm looking at more tests in the 7822-ssl-verify branch which test Proxy::Launcher's https_app by spinning up the rack/WEBrick app and then make requests, but this will take more refactoring.  I will probably follow up with this in another ticket, and only to develop (not 1.6 etc).

No CVE assigned yet - will add it to commit message before it's merged.
As we are most likely going to need ssl client cert verification for all modules accessible over https, I wonder if instead of using a helper it would be better (as in less repetitious) to have a global filter, defined around here.