Backport of fix mTLS certificate check on agent to agent RPCs into release/1.2.x

[hc-github-team-nomad-core]

Backport

This PR is auto-generated from #11998 to be assessed for backporting due to the inclusion of the label backport/1.2.x.

The below text is copied from the body of the original PR.

---

PR #11956 implemented a new mTLS RPC check to validate the role of the
certificate used in the request, but further testing revealed two flaws:

1. client-only endpoints did not accept server certificates so the
   request would fail when forwarded from one server to another.
2. the certificate was being checked after the request was forwarded,
   so the check would happen over the server certificate, not the
   actual source.

This PR checks for the desired mTLS level, where the client level
accepts both, a server or a client certificate. It also validates the
cercertificate before the request is forwarded.

#11956 was never released, so no CHANGELOG needed.

[github-actions]

I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.