[RFC] Fix https-only config

[koct9i]

• Add cluster option "secureCluster"
  Issue: Jobs ignore DisableHTTP option #285

This options enforces internal clients to use secure connections and
validates that related servers are ready to handle TLS.

Also it forces TLS-only mode for native bus transport and
HTTPS-only for default role of HTTP proxies.

I.e. if it is enabled - only non-default HTTP proxies and
any RPC proxies could be not strictly TLS-only.

[koct9i]

Should be something like this, but this does not work yet.

"YT_PROXY=https://fqdn" is still broken somewhere.
Also ca-bundle isn't passed properly to yt cli/sdk.

[sgburtsev]

Should be something like this, but this does not work yet.

"YT_PROXY=https://fqdn" is still broken somewhere. Also ca-bundle isn't passed properly to yt cli/sdk.

JFYI: Ability to pass own CA in Go SDK was added quite a while ago: ytsaurus/ytsaurus@16a5beb

[sgburtsev]

How will this new option useHttps coexist with disableHttp?
There would be some corner cases:

1. useHttps and disableHttp will not work without httpsSecret;
2. with disableHttp useHttps is mandatory.

It might make more sense to only use disableHttp as it almost duplicates useHttps.

[koct9i]

It would be nice to have this ytsaurus/ytsaurus#898
to simplify switching to https just by passing "https://" schema as cluster url.