pw_tls_client: Add public APIs and documentation

Change-Id: I215c5a541ae4cabb1f1f26ee2620e32fcdf7ed55
Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/44567
Reviewed-by: Ali Zhang <alizhang@google.com>
Reviewed-by: Wyatt Hepler <hepler@google.com>
Reviewed-by: Zoltan Szatmary-Ban <szatmz@google.com>
Reviewed-by: Ewout van Bekkum <ewout@google.com>
Reviewed-by: Tennessee Carmel-Veilleux  <tennessee@google.com>
Reviewed-by: Terence Hampson <thampson@google.com>
Reviewed-by: David Palchak <palchak@google.com>
Commit-Queue: Yecheng Zhao <zyecheng@google.com>
diff --git a/pw_tls_client/BUILD b/pw_tls_client/BUILD
new file mode 100644
index 0000000..93bf559
--- /dev/null
+++ b/pw_tls_client/BUILD
@@ -0,0 +1,48 @@
+# Copyright 2021 The Pigweed Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy of
+# the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations under
+# the License.
+
+load(
+    "//pw_build:pigweed.bzl",
+    "pw_cc_facade",
+    "pw_cc_library",
+)
+
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])  # Apache License 2.0
+
+pw_cc_facade(
+    name = "pw_tls_client_facade",
+    hdrs = [
+        "public/pw_tls_client/options.h",
+        "public/pw_tls_client/session.h",
+        "public/pw_tls_client/status.h",
+    ],
+    includes = ["public"],
+    deps = [
+        "//pw_assert",
+        "//pw_bytes",
+        "//pw_result",
+        "//pw_status",
+        "//pw_stream",
+    ]
+)
+
+pw_cc_library(
+    name = "pw_tls_client",
+    deps = [ ":pw_tls_client_facade" ],
+)
+
+# TODO(zyecheng): Add a "backend_multiplexer" target once BoringSSL/MbedTLS is
+# ready.