POSTGRES_PASSWORD is required to be set when using POSTGRES_HOST_AUTH_METHOD=cert

I'd like to be able to write a configuration that uses mutual TLS with the auth method cert, which does not require a password and instead enforces that the user is equal to the common name of the authenticated client certificate.

However, the only passwordless auth method permitted by by the docker entrypoint script's docker_verify_minimum_env function is trust:

https://github.com/docker-library/postgres/blob/74e51d102aede317665f2b4a9b89362135402fe7/docker-entrypoint.sh#L119

It seems like adding another case to this check to allow for using certificate-based authentication. One concern I have, though, is that there are auth options as well that may be needed, e.g., looking at the pg_setup_hba_conf function below, it appears that if I want to end up with a pg_hba.conf file with cert clientcert=verify-full, that full string (i.e., including the auth options) would need to be set in the POSTGRES_HOST_AUTH_METHOD environment variable as written. I'm not sure if it would make more sense to add a new environment variable for that purpose? There is also no way that I can identify to use hostssl instead of host, though with cert authentication I'm not sure that actually matters.

https://github.com/docker-library/postgres/blob/74e51d102aede317665f2b4a9b89362135402fe7/docker-entrypoint.sh#L251

Start with docker-entrypoint.sh, especially docker_verify_minimum_env and pg_setup_hba_conf at the linked locations, to trace how POSTGRES_HOST_AUTH_METHOD is validated and written to pg_hba.conf. Define the supported certificate-authentication input, including any auth options or hostssl behavior, and consider how completion can be verified for the resulting configuration.