Support client certificates for service authentication

[tsandall]

Currently the service client used for bundle downloading, status reporting, and decision log uploading only supports bearer tokens for authentication. Some users would prefer to rely on client certificates.

The credentials configuration could be extended to include a "client_tls" key:

credentials:
  client_tls:
    cert: /path/to/cert
    private_key: /path/to/key
    private_key_passphrase: 1234

Service clients are instantiated from configuration here. To implement this enhancement, we need to extend the client configuration defined earlier in that file with the client TLS parameters defined above. The validation step should load and parse files from disk (returning errors if necessary). In addition, the HTTP client used internally will need to configured with the TLS certificates.