feat: present a client certificate for mutual TLS

[DavidCozens]

Add a client certificate and its key to the stream config. The handshake then authenticates the
device to the collector, as well as the collector to the device.

struct SolidSyslogMbedTlsStreamConfig tlsConfig = {
    /* ... as the previous TLS stage ... */
    .ClientCertChain = DeviceCertStore_ClientChain(),
    .ClientKey       = DeviceCertStore_ClientKey(),
};

Both fields must be set. Supplying one and not the other leaves the connection server-authenticated
and does not fail, so the pipeline element is given what the device holds rather than what was
configured:

s_sd[3] = SyslogPipelineSd_Init((clientChain != NULL) && (clientKey != NULL));

... [logPipeline@32473 transport="mtls" atRest="hmac-sha256"] device started

The handshake authenticates the TLS peer. Where a relay, gateway or broker terminates the connection,
the collector authenticates that hop rather than the device behind it, and the origin element
carries the device's own identity across it.

The collector port used here requires a client certificate and refuses a client that presents none.

The mbedTLS pool moves from 53 to 55 KiB, following this device's existing rule of peak times 1.5
rounded up to the next KiB.

[coderabbitai]

Note

Reviews paused

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[DavidCozens]

@coderabbitai pause

[coderabbitai]

✅ Action performed

Reviews paused.