43848: pgwire: properly support unix socket clients with authentication r=knz a=knz

Fixes #31113. cc @rolandcrosby 
(All commits except for the last from #43837 and #43843)

tldr: this patch makes unix sockets more production-ready,
by enabling clients to use unix sockets in secure mode
and enabling authentication over unix sockets.

**Motivation:**

[Unix domain
sockets](https://en.wikipedia.org/wiki/Unix_domain_socket) are a way
for a server process to accept direct in-memory connections from
processes running on the same machine as the server. They are simpler
and faster as they avoid the TCP/IP stack entirely.

Unix sockets are used both to provide a local client interface
for administrator users operating the system; as well as
setting up more complex authentication systems using the following
topology:

```
         client
           ^
           |
     (non-standard protocol)
           |
.----------|--------------(server machine)--------------------------.
|          v                                                        |
| ,----------------------.                   ,--------------------. |
| |  connection proxy    |                   | server process     | |
| |  and transport-level |<--(unix socket)-->| and authentication | |
| |   security           |                   | (e.g. crdb)        | |
| `----------------------'                   `--------------------' |
`-------------------------------------------------------------------'
```

**Description of this change:**

CockroachDB already supports setting up a unix socket for use by
clients running on the same machine, subject to regular Unix
permission checks.

Prior to this patch, support for unix sockets was incomplete:

- it would work properly for insecure nodes/clusters; however, ...
- ... in secure mode, it would also require a TLS handshake over
  the unix socket, which is neither supported by pg clients
  nor meaningful: unix domain sockets have transport-level
  security already.

This patch extends/fixes support for unix sockets as follows:

- it properly accepts client connections without TLS over
  unix sockets;
- it subjects incoming unix socket connections to the standard HBA
  rule-based authentication selection (via the cluster setting
  `server.host_based_authentication.configuration`);
- it changes the default HBA configuration to contain
  a default `local` rule that requires password
  authentication, in a way compatible with PostgreSQL;
- it un-hides the `--socket` parameter from the output of
  `cockroach start --help`.

Release note (cli change): Connections using Unix sockets are now
accepted even when the server is running in secure more.
(Consult `cockroach start --help` for details about the `--socket`
parameter.)

Release note (security): Connections using unix sockets are now
subject to the HBA rules defined via the setting
`server.host_based_authentication.configuration`, in a way compatible
with PostgreSQL: incoming unix connections match `local` rules,
whereas incoming TCP connections match `host` rules.
The default HBA configuration used when the cluster
setting is empty is now:

    host      all root all cert
    host      all all  all cert-password
    local     all all      password

Co-authored-by: Raphael 'kena' Poss <knz@thaumogen.net>