HttpClient client certificate support

In preview 12 #994 reverted support for client certificates on the proxy http client for the following reasons:
- It's different between the json config model and the code config model
- it requires passwords in the json config
- There's no rotation support, you have to modify the cluster config to point at a new cert and trigger a reload
- Multiple config provider implementations are using System.Text.Json to serialize the code model across processes, but that doesn't make sense for X509Certificate2.
- Cert lifetime issues across config reloads. The current model requires a complex weak reference cache.

For now people need to use the ProxyHttpClientFactory customizations to add their client certificate programmatically. They become responsible for managing the credentials and lifetime of the certs.

We do still want to have this feature, but we need to address the above concerns. One idea is to move the certificate management to its own service so that it's pluggable and would work independently of the config provider. HttpClientConfig for the cluster would reference the certificate by string id, similar to how auth and cors policies work. Then ProxyHttpClientFactory would call into the cert service to retrieve the matching cert. There would need to be implementations of the service that supported the following:
- Let callers look up certs by name (Contains(name), TryGetCert(name, out cert))
- Loading certificates from a variety of locations and monitor them for changes. An implementation may only need to support one location type and you'd switch implementations to support other sources, much like IProxyConfigProvider.
- Some way for the service to trigger a config reload notification when a cert change was detected so ProxyHttpClientFactory can re-run