proxy: optional server-side verification

[xhebox]

Signed-off-by: xhe xw897002528@gmail.com

What problem does this PR solve?

Issue Number: ref #136

Problem Summary: Serverless tier will provide CA now, which results into rejections to all clients without providing certs. This can be solved by not-specifying CA, or the new semantic of TLSConfig:

For a server TLS config, if ca is specified and skip-ca==true, server will not require clients to provide certs, but recommend/request clients to provide certs if any.

What is changed:

1. new semantic for server TLS
2. make createTempTLS private, expose CreateTLSCertificates to remove AutoTLS
3. remove autoCertInterval, which is replaced by refactored certInfo.expire
4. refactored cert manager tests to be simpler and cover more about rotation(improve coverage by 0.3%). Rotation(CA and certs) are covered by TestRotate. And TestInit covered some configuration tests. Internal details of certs should be covered by pkg/lib/util/security/cert_test.go.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No code

Notable changes

• Has configuration change
• Has HTTP API interfaces change (Don't forget to add the declarative for API)
• Has tiproxyctl change
• Other user behavior changes

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

None

[djshow832]

Why not just remove skip-ca?

[xhebox]

Why not just remove skip-ca?

Then we can not enforce server-side verification if someone wants to do so. Or we can't let clients to skip cert checks.