Low: executor: mark controller connections to pacemaker-remoted as privileged

Previously, pcmk__client_privileged was only set when local clients connected
(as root or hacluster). Now, set it when pacemaker-remoted successfully
completes the TLS handshake with a remote client (i.e., the controller on a
cluster node).

This has no effect as of this commit but will with later commits.