contrib/plugins: add mTLS binary cache store plugin

Adds an example plugin implementing an mTLS-enabled binary cache store
(https+mtls:// scheme) using client certificates for authentication.

Darwin fix: don't link liblix* into plugins (host resolves symbols at
runtime via dynamic_lookup). Explicitly link curl so it binds to
Nix-store libcurl, not /usr/lib/libcurl. This prevents the plugin's
curl_easy_setopt calls from operating on the wrong libcurl instance.

Test portability: BSD sed -i wrapper, OpenSSL -sha256 for cert signing,
redirect test server output to log file.

Change-Id: I652b987d3ac45e31df50ff4ba1f523294438c2b6

contrib/plugins/mtls-http-binary-cache-store.md

@@ -0,0 +1,14 @@
+R"(
+
+**Store URL format**: `https+mtls://...`
+
+This store allows a binary cache to be accessed via HTTPS with mutual TLS (client certificate authentication).
+
+Both parameters are required:
+
+- `tls-certificate`, a path to the TLS client certificate
+- `tls-private-key`, a path to the TLS private key backing the client certificate
+
+If you don't need mTLS, use `https://` instead.
+
+)"