Support specifying client TLS certificate

[travisgroth]

Is your feature request related to a problem? Please describe.

We currently support two subcommands that make a request to services that are behind the Pomerium Proxy. However, neither command accepts a client TLS cert and key when making the underlying HTTP connection.

In some environments, client certificates function as stand ins for device state or other inventory based controls, but these don't currently work with the tcp and k8s subcommands.

Describe the solution you'd like

Support passing a TLS certificate and key file path as command line flags to both tcp and k8s commands.

Describe alternatives you've considered

n/a

Explain any additional use-cases

The desktop client will also need to support this for tcp tunnels.

Additional context

Related pomerium/pomerium#2983

[travisgroth]

/cc @cfanbo

[wasaga]

Per internal discussion - we will not support password protected keys