API Gateway with mTLS support

By default, the TLS protocol only requires a server to authenticate itself to the client. The authentication of the client to the server is managed by the application layer. The TLS protocol also offers the ability for the server to request that the client send an X.509 certificate to prove its identity. This is called mutual TLS (mTLS) as both parties are authenticated via certificates with TLS.

Mutual TLS is commonly used for business-to-business (B2B) applications. It’s used in standards such as Open Banking, which enables secure open API integrations for financial institutions across the United Kingdom and Australia. It’s common for Internet of Things (IoT) applications to authenticate devices using digital certificates. Also, many companies authenticate their employees before granting access to data and services when used with a private certificate authority (CA).

### Use Case

mTLS APIs require a number of additional steps compared to regular APIs:

- Upload a truststore.pem to S3 for client certificate verfication in API GW (S3)
- Create a customer domain for the API GW (Route53)
- Request and validate a certificate (ACM)

The construct aims to simplifies this use case.

### Proposed Solution

I already implemented this for a different project (see code below) and believe that it can be useful for others.

I will add the following things:
- add tests
- adhere to code guidelines
- add architecture diagram + README
- make construct customizable via props

```
export default class PublicRestApiWithMutualTLS extends Construct {
apiGw: RestApi

constructor(scope: Construct, id: string, props: PublicRestApiWithmTLSProps) {
super(scope, id);

const apiDomainName = `api.${props.hostedZone.zoneName}`;
const apiCert = new DnsValidatedCertificate(this, 'ApiCertificate', {
domainName: apiDomainName,
hostedZone: props.hostedZone,
region: Stack.of(this).region,
});

const certBucket = new Bucket(this, 'TruststoreCertificatesBucket', {
bucketName: 'some.bucket.name',
autoDeleteObjects: true,
removalPolicy: RemovalPolicy.DESTROY,
});

const truststoreCertificateFileName = 'truststore.pem';

new BucketDeployment(this, 'TruststorePemUpload', {
sources: [Source.asset('./cert/latest', {
exclude: ['**', `!${truststoreCertificateFileName}`],
})],
destinationBucket: certBucket,
retainOnDelete: false,
});

const fn = new Lambda(..)

const logGroup = new LogGroup(this, 'APiGwLogGroup', {
logGroupName: 'apigw/rest/PublicWithMutualTLS',
removalPolicy: RemovalPolicy.DESTROY,
});

this.apiGw = new RestApi(this, 'PublicApi', {
endpointConfiguration: {
types: [EndpointType.REGIONAL],
},
disableExecuteApiEndpoint: true,
restApiName: 'Public with mTLS',
description: `A public REST API Gateway with mutual TLS on a custom domain (${apiDomainName})`,
domainName: {
domainName: apiDomainName,
endpointType: EndpointType.REGIONAL,
certificate: apiCert,
securityPolicy: SecurityPolicy.TLS_1_2,
mtls: {
bucket: certBucket,
key: `/${truststoreCertificateFileName}`,
},
},
});

new ARecord(this, 'ARecord', {
zone: props.hostedZone,
recordName: apiDomainName,
target: RecordTarget.fromAlias(new ApiGateway(this.apiGw)),
});

this.apiGw.root.addMethod('GET', new LambdaIntegration(fn));
}
}

```

### Other

* [x] :wave: I may be able to implement this feature request
* [ ] :warning: This feature might incur a breaking change

---

This is a :rocket: Feature Request

No repository file or test is named in the issue; first locate the TypeScript construct entry point and existing test conventions. Compare the proposed mTLS flow—S3 truststore, Route53 custom domain, ACM certificate, API Gateway, and Lambda—with project guidelines, with tests, customizable props, an architecture diagram, and a README defining done.

Written by the indexing model from the issue text.