Function build_mtls_server_config 

pub fn build_mtls_server_config(
    cert_path: &str,
    key_path: &str,
    ca_cert_path: &str,
    pinned_certs: &[String],
    crl_path: &str,
) -> Result<ServerConfig>

Build a TLS 1.3-only [rustls::ServerConfig] that always requires and verifies a client certificate. See build_mtls_acceptor; this is the inner config builder. There is no no-client-auth branch here by design. crl_path, when non-empty, refuses a revoked client certificate (A5).