Bazel downloader should support `--tls_client_certificate` and `--tls_client_key`

### Description of the feature request:

The command line options `--tls_client_certificate` and `--tls_client_key` currently only work with Bazel remote cache and remote execution. They should also be supported by Bazel downloader to authenticate with a protected server.

The discussion https://github.com/bazelbuild/bazel/discussions/19560 discusses a workaround modifying the Bazel JVM and providing a special keystore. However, that's tedious and should be unnecessary given that the command line options already exist.

### Which category does this issue belong to?

_No response_

### What underlying problem are you trying to solve with this feature?

mTLS authentication to a protected server for all Bazel downloads/fetches

### Which operating system are you running Bazel on?

_No response_

### What is the output of `bazel info release`?

_No response_

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start by tracing Bazel downloader handling for the existing --tls_client_certificate and --tls_client_key options. Check how downloader authentication differs from remote cache and execution, then verify that downloads and fetches can use mutual TLS against a protected server.

Written by the indexing model from the issue text.