return public_key for clients in all cases

To be consistent with the open-source API and tools that are depending
on it, we should always return public keys with client objects instead
of certificates. The following is a situation that we've recently
encountered:

  * consumer of API switches on the response having json_class field
  * response inflates to a Chef::ApiClient if json_class is set
  * if inflated, consumer expects the public_key field to be set
  * if not inflated (no json_class), consumer expects certificate
    field to be set

This commit ensures that we always set both json_class and
public_key, the combination that the Ruby chef-client code expects.
chef_client: add tests for converting certs to public keys
chef_client: prefer public key over certificate