Make CertificateAuthenticator use the cert

This is part of a RFC change (see bootstrapping rfc):

raw notes:

• move client cert from security config to cert authenticator
• add supportsTls() bool, supportsNonTls() bool
• check on bootstrap instead looking for the cert authenticator directly

CertificateAuthenticator {

  supportsTls() { true }

  supportsNonTls() { false }

}

PasswordAuthenticator {

  supportsTls() { true }

  supportsNonTls() { true }

}