tls-server: Add flag that makes client authentication optional

This allows clients to send an empty certificate payload if the server
sent a certificate request.  If an identity was set previously, it will
be reset so get_peer_id() may be used to check if the client was
authenticated.

src/libtls/tls.h

@@ -207,6 +207,8 @@ enum tls_name_type_t {
 enum tls_flag_t {
 	/** set if cipher suites with null encryption are acceptable */
 	TLS_FLAG_ENCRYPTION_OPTIONAL = 1,
+	/** set if client authentication is optional even if cert req sent */
+	TLS_FLAG_CLIENT_AUTH_OPTIONAL = 2,
 };
 
 /**