feat: add TlsHelper, PeekableStream, and TlsRateLimiter

Add TLS utility classes for certificate loading, peekable stream for TLS
detection, token-bucket rate limiter for handshake throttling, and
TlsConnectionState for post-handshake info. Add TlsState property to
NatsClient. Fix X509Certificate2 constructor usage for .NET 10 compat.

src/NATS.Server/NatsClient.cs

@@ -7,6 +7,7 @@ using System.Text.Json;
 using Microsoft.Extensions.Logging;
 using NATS.Server.Protocol;
 using NATS.Server.Subscriptions;
+using NATS.Server.Tls;
 
 namespace NATS.Server;
 
@@ -55,6 +56,8 @@ public sealed class NatsClient : IDisposable
     private int _pingsOut;
     private long _lastIn;
 
+    public TlsConnectionState? TlsState { get; set; }
+
     public IReadOnlyDictionary<string, Subscription> Subscriptions => _subs;
 
     public NatsClient(ulong id, Stream stream, Socket socket, NatsOptions options, ServerInfo serverInfo,