The server allows configuring on a per-proxy vendor basis how X509 Client Certificates are resolved when running behind a proxy.

This capability is backed by the x509-client-lookup SPI which provides implementations for haproxy, apache, and NGINX.

The proposal here is to make x509-client-lookup SPI configuration as much as transparent as possible to users and avoid using SPI configuration options as documented in the Proxy Guide.

See #10091.