Add TLS middleware with sample

[ReubenBond]

This PR adds support for securing client-to-silo and silo-to-silo connections using mutual-TLS.
Adds several UseTls methods to ISiloBuilder, IClientBuilder, and ISiloHostBuilder.

TLS can be configured on the silo like so:

var host = new HostBuilder()
    .UseOrleans((context, siloBuilder) =>
    {
        var isDevelopment = context.HostingEnvironment.IsDevelopment();
        siloBuilder
            .UseLocalhostClustering(serviceId: "HelloWorldApp", clusterId: "dev")
            .UseTls(StoreName.My, "fakedomain.faketld", allowInvalid: isDevelopment, StoreLocation.LocalMachine, options =>
            {
                if (isDevelopment)
                {
                    options.AllowAnyRemoteCertificate();
                }
            });
    })
    .ConfigureLogging(logging => logging.AddConsole())
    .Build();

By default, when the UseTls extension method is used, both sides of all connections are required to present a certificate.

This adds a new package: Microsoft.Orleans.Connections.Security which targets netcoreapp3.0 only and therefore .NET Core 3.0 is required to use this functionality.

A sample application is included under Samples\3.0\TransportLayerSecurity.

There are some rough edges here which I would especially like feedback on. For example, a TargetHost must be set whenever a connection is made. I would like to know how users would expect to set this value. In the provided sample the value is set to a fixed value:

.UseTls(StoreName.My, "fakedomain.faketld", allowInvalid: true, StoreLocation.LocalMachine, options =>
{
    options.OnAuthenticateAsClient = (connection, sslOptions) =>
    {
        sslOptions.TargetHost = "fakedomain.faketld";
    };
    // NOTE: Do not do this in a production environment
    options.AllowAnyRemoteCertificate();
})

I understand that this will not suffice for all cases. The connection parameter has a Features property which allows the users to determine which endpoint is being connected to (among other things). This could be used to determine the correct TargetHost value.

Fixes #828

xref dotnet/aspnetcore#12809

[davidfowl]

Don't replicate the Adapter naming mistake we made 😄

[ReubenBond]

s/Https/Tls 😅
Perhaps TlsOptions is a nicer name for this, or TlsConnectionOptions

[JanEggers]

@ReubenBond can you please let me know when there is a preview that includes this. I would like to use the TLS middleware for this: https://github.com/chkr1011/MQTTnet/tree/master/Source/MQTTnet.AspnetCore

[ReubenBond]

@JanEggers you can take the current commit if you like - that MQTT project doesn't reference Orleans & the important bits are internal so I don't think a build of this would be useful

[JanEggers]

@ReubenBond thx for letting me know, I didnt look at the code in detail yet. I was hoping I could just use the extension method on IConnectionBuilder and be done.

[ReubenBond]

@JanEggers eventually yes, but those things are marked as internal in this PR because the user isn't supposed to interact with them. The intention it to upstream this to Bedrock eventually

[RehanSaeed]

Is it possible to configure TLS using IConfiguration similar to the way HTTPS can be configured for Kestrel?

{
  "Kestrel": {
    "Endpoints": {
      "Http": {
        "Url": "http://localhost:5000"
      },

      "HttpsInlineCertFile": {
        "Url": "https://localhost:5001",
        "Certificate": {
          "Path": "<path to .pfx file>",
          "Password": "<certificate password>"
        }
      },

      "HttpsInlineCertStore": {
        "Url": "https://localhost:5002",
        "Certificate": {
          "Subject": "<subject; required>",
          "Store": "<certificate store; required>",
          "Location": "<location; defaults to CurrentUser>",
          "AllowInvalid": "<true or false; defaults to false>"
        }
      },

      "HttpsDefaultCert": {
        "Url": "https://localhost:5003"
      },

      "Https": {
        "Url": "https://*:5004",
        "Certificate": {
          "Path": "<path to .pfx file>",
          "Password": "<certificate password>"
        }
      }
    },
    "Certificates": {
      "Default": {
        "Path": "<path to .pfx file>",
        "Password": "<certificate password>"
      }
    }
  }
}

[ReubenBond]

The current implementation does not explicitly add support for that, but it doesn't stop you from using IConfiguration yourself. This could be a good area for contribution