support CRL with server/client encryption options

[ajmaidak]

Best I can tell scylla doesn't support a certificate revocation list for either server or client encryption options. Thus if a TLS client private key is leaked you would need to remove the signing CA from the trust store to decline connections from clients using that certificate. Ideally you would append the leaked clients certificate the CRL instead.

It would be a good enhancement to support providing a CRL file argument to the client_encryption_options and server_encryption_options configuration hashes, like:

client_encryption_options:
    enabled: True
    certificate: conf/scylla.crt
    keyfile: conf/scylla.key
    truststore: conf/truststore.pem
    certficate_revocation_list: conf/revoked-certs.crl
    require_client_auth: True

[avikivity]

/cc @elcallio

[elcallio]

https://www.gnutls.org/manual/html_node/PKIX-certificate-revocation-lists.html

Relatively easy to implement, though if it is gonna match everything else, it should have an auto-reload sibling, and a number of adapting versions similar to certs/keys.

[elcallio]

Turns out I had already written the code in seastar from the get-go. Only need to add scylla support in config.