InitClientCertMetadataRules compares the defined rules against client CAs set in `client_ca_certs`.

VerifyClientCertMetadata checks for the certificate chain received from the tls.Config.VerifyPeerCertificate function callback, whether any configured VerifyClientCertificateMetadataRule applies.

CertSubject defines the same fields as pkix.Name and allows YAML declaration of said fields.

VerifyClientCertificateMetadataRules defines verification rules for client certificates, which allow additional checks for the certificates' subject.