[Finnlife]

Adds an optional mTLS client certificate so the agent can talk to a reverse proxy
that requires one. The use case is locking down the publicly reachable endpoints
of a self hosted server so they don't answer anonymous requests at all.

This does not change existing behavior. Without the new flags the agent behaves
exactly as before, -insecure included. It adds two installer flags,
-client-cert and -client-key, and two config values: ClientCert and
ClientKey in the registry on windows, clientcert and clientkey in
/etc/tacticalagent on unix. Both have to be given together, the installer
aborts if only one is set or a file doesn't exist.

The cert is used for the rest client, the nats connection (both wss and standard
tcp), the installer requests and the self update / nushell / deno downloads. Go
only sends a client cert when the server actually asks for one, so the github
downloads are unaffected. Chocolatey and the public ip lookup are untouched.

One small side effect in install.go: SetTLSClientConfig now runs before
SetRootCertificate, because resty replaces the whole tls config and the root ca
from -cert was getting dropped. That path was only reachable together with
-insecure before, so it never showed.

This is an extra transport level gate in front of the existing token auth, not a
replacement for it. The mesh agent is a separate binary and not covered.

Tested on windows against nginx.

[CLAassistant]

All committers have signed the CLA.