authorize: add client mTLS support (#751)

* authorize: add client mtls support

* authorize: better error messages for envoy

* switch from function to input

* add TrustedCa to envoy config so that users are prompted for the correct client certificate

* update documentation

* fix invalid ClientCAFile

* regenerate cache protobuf

* avoid recursion, add test

* move comment line

* use http.StatusOK

* various fixes

scripts/protoc

@@ -0,0 +1,22 @@
+#!/bin/bash
+set -euo pipefail
+
+_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+_protoc_version="3.12.1"
+_protoc_path="/tmp/pomerium-protoc/protoc-$_protoc_version"
+_os="linux"
+if [ "$(uname -s)" == "Darwin" ]; then
+  _os="osx"
+fi
+
+if [ ! -f "$_protoc_path" ]; then
+  echo "downloading protoc"
+  mkdir -p "/tmp/pomerium-protoc"
+  curl -L \
+    -o protoc.zip \
+    "https://github.com/protocolbuffers/protobuf/releases/download/v$_protoc_version/protoc-$_protoc_version-$_os-x86_64.zip"
+  unzip -p protoc.zip bin/protoc >"$_protoc_path"
+fi
+chmod +x "$_protoc_path"
+
+exec "$_protoc_path" --plugin="protoc-gen-go=$_dir/protoc-gen-go" "$@"