Add identity-based TLS auth and UI for client/daemon auth

Add identity-based TLS authentication and use public keys to authenticate access.
This is an implementation of the proposal from #7667.

FSNotify support has not been added to detect changes to authorized keys but may be added in a follow up PR.

If the handshake has been completed there will be at least one peer certificate. The handshake will be completed on dial or return an error. Here is an example of the standard go library making the same assumption http://golang.org/src/crypto/tls/conn.go#L1029