Refactor the client (again) to better support auth

Allows consumers to provide their own transports for common cases.

Fixes #1499
Adds basic support for #1473
client.New does not appear to call api.NewContext.  I see it being set in kubecfg main, but not in any of the tests.  Is that change intentional?