[Feat/bug] TLS config, allow to define x509.VerifyOptions.KeyUsages

Proposal

Since this: Ending TLS Client Authentication Certificate Support in 2026

• LE removed "TLS Client Authentication EKU" (this is just some field)
• Modern Go strictly enforces that if a specific usage is requested in VerifyOptions, the certificate must have it.

Please add to AM option, with that administrator can disable check for "X509v3 Extended Key Usage", because we okay with just cert is valid

Example gossip configuration:

tls_client_config:
    cert_file: /etc/pki/tls/private/le/fullchain.pem
    key_file: /etc/pki/tls/private/le/privkey.pem
    server_name: am2.example.com
tls_server_config:
    cert_file: /etc/pki/tls/private/le/fullchain.pem
    client_auth_type: RequireAndVerifyClientCert
    key_file: /etc/pki/tls/private/le/privkey.pem
    min_version: TLS13

Alertmanager log:

Apr 03 16:14:26 am2.example.com alertmanager[1853810]: time=2026-04-03T16:14:26.440+07:00 level=DEBUG source=net.go:974 msg="[DEBUG] memberlist: Initiating push/pull sync with:  100.100.101.30:9094" component=cluster
Apr 03 16:14:26 am2.example.com alertmanager[1853810]: time=2026-04-03T16:14:26.443+07:00 level=DEBUG source=memberlist.go:288 msg="[DEBUG] memberlist: failed to join 100.100.101.30:9094: remote error: tls: bad certificate" component=cluster
Apr 03 16:14:26 am2.example.com alertmanager[1853810]: time=2026-04-03T16:14:26.443+07:00 level=DEBUG source=cluster.go:440 msg=failure component=cluster msg=reconnect peer="" addr=100.100.101.30:9094 err="1 error occurred:\n\t* failed to join 100.100.101.30:9094: remote error: tls: bad certificate\n\n"
Apr 03 16:14:27 am2.example.com alertmanager[1853810]: time=2026-04-03T16:14:27.336+07:00 level=DEBUG source=tls_transport.go:275 msg="error reading from connection" component=cluster err="error reading message length: tls: failed to verify certificate: x509: certificate specifies an incompatible key usage"

Start by tracing the Go TLS configuration paths for tls_client_config and tls_server_config, then read how x509.VerifyOptions and certificate key usages are selected. Define where the administrator option belongs and verify that disabling the Extended Key Usage check permits the shown certificates while retaining other certificate validation.