Bug 4005: Dynamic certificate cache exceeds dynamic_cert_mem_cache_size

Bug 4005: Dynamic certificate cache exceeds dynamic_cert_mem_cache_size

* disable the use of system CA by default to verify client connection
  certificates. Since the use of client certificates is rare.

* no change to verification of upstream server or peer certificates.
  Since the use of system CA to sign server certificates is common.

* the new "default-ca" configuration option and its documentation are
  updated to make the situation more obvious amongst the other TLS options
  changes in Squid-4.

* the action of the sslflags=NO_DEFAULT_CA is already deprecated, so no
  change when it is used. On port lines it now merely sets the default.

It may be a good idea to also disable system CA use for cache_peer and
ICAPS connections. For now they are left unchanged.