change: return invalid credentials errors on custom nginx error codes for incorrect client cert

[mgoetzegb]

What

Return invalid credentials errors on custom nginx error codes for incorrect client cert.

This improves the user feedback in some cases when supplying invalid client certificates.

However this covers only a subset of possible server behaviors on invalid client certificates, but those are the only cases which can be clearly attributed to invalid/missing client certs.

Some common server responses from CSAF Provider on invalid or missing client certificate:

• http status 400 (bad request): https://docs.apigee.com/api-platform/troubleshoot/runtime/400-ssl-certificate-error
• custom NGINX http error codes 495 or 496: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#errors (now covered)
• termination of connection (transport level error): https://cloud.google.com/load-balancing/docs/mtls

Why

Better error feedback.

References

VTI-659

[github-actions]

Conventional Commits Report

Type	Number
Changed	1

🚀 Conventional commits found.

[mgoetzegb]

tests fail with go version 1.25.2, but pass with 1.25.0, failure is not related to this PR

[github-actions]

Modver result

This report was generated by Modver,
a Go package and command that helps you obey semantic versioning rules in your Go module.

This PR does not require a change in your module’s version number.
(You might still consider bumping the patchlevel anyway.)