caddyhttp: Evaluate tls.client placeholders more accurately (fix #7530)

[mholt]

This should cause placeholders to be replaced with empty string when ReplaceKnown() is used, even if no client cert is presented.

Assistance Disclosure

No AI was used.

[felixhummel]

LGTM. I verified against #7530.

$ cd ~/github/caddy
$ git checkout client-cert-placeholders
$ cd cmd/caddy/
$ go build
$ cd ~/repro/caddy-tls-subject-header-up
$ go run ./echo/main.go :44001
$ ~/github/caddy/cmd/caddy/caddy run --config Caddyfile --watch
$ curl -fsSL --cacert 0-tmp-ca.crt https://example.localhost:44443 | rg ^X-Sub
X-Subject:
X-Subject-Long-Placeholder:

[francislavoie]

This could be a breaking change for configs that rely on a missing cert returning false (e.g. vars matcher maybe).

Makes sense to me though in principle.

[mholt]

Thank you both! (And yes, that's true.)