[Feature]: Elasticsearch — support xpack.security.http.ssl.client_authentication (request client certs) #537

The server half of mutual TLS: by default Elasticsearch does not request a client certificate (security settings). Add support for xpack.security.http.ssl.client_authentication (optional / required) so ES requests and validates a client certificate on the HTTP layer.

Without this, any client certificate presented by Beats/Logstash/Kibana is ignored (which is exactly today's state). Requires HTTP TLS to be on (elasticsearch_http_security). Opt-in, default none (unchanged behaviour).

Foundation for the client-side children — they depend on this. Part of #536. 2.0.0.