We've been actually assuming ACLs were working this way in all our
configuration files, so better make it so: the first path match in the
ACL allow list will cause the list iteration to stop (the final result
will then depend on the CN match).

The clients already support it (via the default net/http.Transport),
and it can be enabled with a configuration parameter. The default is
still currently disabled, though there is plan to flip it later to
enabled-by-default if it proves to be working as expected in
production.

We also introduce, via a slight refactoring of the Serve() code, a
test of the top-level http.Handler (with the full middleware stack).

Use mime.ParseMediaType to obtain the main content type.

It was acting as an upper limit for the request lifetime, which isn't
necessary on internal services.

This is a high-level timeout for the http.Handler application code,
not a low-level network timeout.

Trace requests on client and server HTTP traffic, using a system-wide
configuration file to control reporting.

And return the right error code (403, not 401).

Doh, don't know how this was missed until now.

Fixes include:
* only notify systemd after the network socket has been opened
* add net/http/pprof debug handlers
* add /health endpoint for Prometheus blackbox prober

Allows users to specify a set of trusted forwarders in the
configuration, and then using github.com/gorilla/handlers.ProxyHeaders
to rewrite the http.Request parameters according to X-Forwarding-* and
X-Real-IP headers.

Reduces cyclomatic complexity score and makes code more readable.

Includes TLS authentication, to authorize peers
based on the subject of their X509 certificate.