Support for mapping user from TLS client certificate

[derekcollison]

This allows a client certificate to identify a user in the NATS system. This is currently a boolen extension to verify, verify_and_map: true

Generally this should be an email and be part of the extended syntax for Subject in the certificate, or what is preferred as SubjectAltName designation. Hence using a simple boolean. If need be we can make it a bool or string in the future if we need to customize how the user is pulled from the cert.

Subject CN
Subject: C=US, ST=CA, L=LA, O=Synadia, OU=NATS.io, CN=localhost/emailAddress=derek@nats.io

SubjectAltName

X509v3 extensions:
            X509v3 Subject Alternative Name: 
                DNS:localhost, IP Address:127.0.0.1, email:derek@nats.io
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication

Go will treat these as per the spec with SubjectAltName being preferred.

Signed-off-by: Derek Collison derek@nats.io

/cc @nats-io/core

[coveralls]

Coverage decreased (-0.2%) to 91.544% when pulling 7978d8e on tls_user into 91fa422 on master.

[kozlovic]

LGTM