private static Optional<X509Certificate> getClientCertificate(DiscFilterRequest request) {
        List<X509Certificate> chain = request.getClientCertificateChain();
        if (chain.isEmpty()) return Optional.empty();
        return Optional.of(chain.get(0));
    }
Authenticates Athenz principal through TLS client authentication (Athenz identity certificate).
The TLS authentication is based on the following assumptions:
 - The underlying connector is configured with 'clientAuth' set to either WANT_AUTH or NEED_AUTH.
 - The trust store is configured with the Athenz CA certificates only.

@author bjorncs
jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/athenz/AthenzPrincipalFilter.java