Provide control port commands to ADD/REMOVE/VIEW v3 client-auth

We need control port commands so that TB can add/remove/view client auth credentials.

Furthermore, the 'add' command should be able to decrypt any existing non-decryptable descriptors in the cache (see legacy/trac#30382 (moved)).