crypto/tls: allow choosing ClientAuth (and others?) based on SNI

[FiloSottile]

tls.Config.ClientAuth is global per server, however there's no reason it shouldn't be a func(clientHello *ClientHelloInfo) (ClientAuthType, *x509.CertPool). See example use case in caddyserver/caddy#829.

On the other hand, the same can be said about NextProtos (already a desired feature, to have HTTP/2 enabled only on some hosts, caddyserver/caddy#189), CipherSuites, SessionTicketKey, ClientSessionCache, CurvePreferences...

I suspect some of them have issues open about them already, but couldn't find them.

[danp]

Probably related to #15699.

[groob]

The ability to do this in a Go application would be great for internet facing services. Currently it's relatively easy to support Let's Encrypt, but this limitation requires us to go back to using HAProxy.

My application bundles a SCEP server to issue client certificates and then requires the client to provide the cert at another SNI. Currently it's impossible to do both in a single Go server without using two separate ports.

[agl]

I hope to spend a week working on Go in the 1.8 cycle and to address this.

[danp]

Noticed title prefix of this issue has a typo: crpyto -> crypto

[bradfitz]

See #16066 for a related issue and my comment #16066 (comment) for one idea.