(fix) Handle caFile alone being set for repos

[mparry]

Previously it was only respected if certFile and keyFile were also
specified. However, these are independent features.

This addresses #3074. (The main motivation was that caFile appears to be a necessary workaround on, for example, MacOS due to golang/go#16532.)

[bacongobbler]

Generally speaking, we try to retain backwards compatibility in public-facing packages where possible. Is there any way we can retain NewClientTLS and introduce NewTLSConfig as a function that calls NewClientTLS instead?

I'd also add some unit tests to pkg/tlsutil, otherwise this looks good.

[mparry]

I have tweaked the change such that NewClientTLS() is reinstated and should work as before. I have also slightly expanded httpgetter_test so that it exercises the new code path at least.

I didn't add any tests directly at the tls level only because there was nothing existing to base them upon, and I didn't want to spend a lot of time inventing some. If you think that the above is still insufficient, I can take another look.

[javefang]

/LGTM, @bacongobbler what do we need before this can be merged?

[mparry]

Rebased against master

[nazarewk]

should also fix #3792 , what is the status of this?