caddyhttp: shield specific hostnames from a covering wildcard's client auth (#7920)