[mTLS] Mutual TLS between cluster nodes

It's not a hard requirement so far by users but it is a "nice to have" and may eventually be a strong need.

Some users are running with very strong authentication/authorization in mind, and we should enable them to go with this end-to-end, including backend cluster nodes.

It would also be interesting if we'd allow a websocket or similar transport to "not clustered" nodes, i.e. what we used to call `ServiceRef` at some point in a design session with @drexin in Tokyo way back when. It would be nice if such service refs over the transport could ensure that the client/server is the one they indeed trust.

No files, tests, or entry points are named. Start by locating the cluster-node transport and authentication code, then determine the design for mutual TLS and trusted communication with non-clustered nodes; done should include an agreed scope and coverage for both cases.

Written by the indexing model from the issue text.