Add wrap-with-certificate-cn middleware

This middleware adds a :ssl-client-cn key to the request map if a
:ssl-client-cert is present. This makes for easier certificate
whitelisting (using the cert whitelisting function from pl/kitchensink).
Also, I didn't see any "unit" test coverage for the real body of `cert->principal`.  Might be good to cover that with a test that passes in a real object that derives from the `X509Certificate` class.  The new test could be thinner if the actual operations on the `X509Certificate` were done down in the jvm-ca library.