pgwire: align client cert validation with pg

[knz]

It so happens that pg also provides fine-grained configuration of how client certs are to be validated:

In addition to the method-specific options listed below, there is one method-independent authentication option clientcert, which can be specified in any hostssl record. This option can be set to verify-ca or verify-full. Both options require the client to present a valid (trusted) SSL certificate, while verify-full additionally enforces that the cn (Common Name) in the certificate matches the username or an applicable mapping. This behavior is similar to the cert authentication method (see Section 20.12) but enables pairing the verification of client certificates with any authentication method that supports hostssl entries.

https://www.postgresql.org/docs/current/auth-pg-hba-conf.html

1. Today cockroachdb only supports either "nothing" (no cert validation whatsoever) or "verify-full" (via the cert auth method). It would be good if pg's other modes could be checked.

2. pg support cert checks in addition to any other auth method. In crdb, cert checks are exclusive with every other method.

cc @aaron-crl

[aaron-crl]

I believe this is related: #47300

[knz]

dup #45953