Username for EAP-TLS authentication should be the email entry of the subject name

Currently the first email entry of the subject alternative names is usde as the user name for EAP-TLS authentication, but it should be the email entry of the subject name.

Change the implementation so, that if available, the email entry of the subject name is used. Only if it is not available fall back to the first email entry of the subject alternative name.