Lumberjack client certificate authentication

Added lumber jack client certificate authentication. Options to specify the CA, optional use of the system CA. Change was so small I didn't do a branch. Corresponding PR for Logstash to follow. 

https://github.com/elasticsearch/logstash/pull/1633
To be clear, this is the case with client certificate authentication turned off (which is the current case). So is not a backwards step - its a slightly forwards in that it would reject self-signed certificates.

You have a very good argument though. Is there actually a use case for using internet PKI. And if the user did in fact replace the local system roots with their own CA - we could simply require them to point directly to that CA root for the same benefit.

I'm swaying towards agreement - removing this option.