Add support for certificates for repositories

This adds support for a /etc/docker-certs configuration file that allows you to specify tls certificate config.

Currently it has two settings:
1) You can specify a list of root CAs in case you're using an https repository that is not signed by a default CA

2) You can specify a per-repository client side certificate and private key to send to the server. This allows the server to e.g. verify that the client is allowed to access a particular image. 

I've set up a local apache that serves as a registry with "SSLVerifyClient optional_no_ca" and a cgi script that verifies that you have a valid client side certificate. It works:

```
# wget --ca-certificate=/etc/pki/tls/certs/localhost.crt https://127.0.0.1/v1/_ping
--2013-12-05 18:59:57--  https://127.0.0.1/v1/_ping
Connecting to 127.0.0.1:443... connected.
HTTP request sent, awaiting response... 403 Client certificate invalid
2013-12-05 18:59:57 ERROR 403: Client certificate invalid.

# docker run 127.0.0.1/busybox echo hello
Unable to find image '127.0.0.1/busybox' (tag: latest) locally
Pulling repository 127.0.0.1/busybox
e9aa60c60128: Pulling image (latest) from 127.0.0.1/busybox 
e9aa60c60128: Pulling image (latest) from 127.0.0.1/busybox, endpoint: https://127.0.0.1/v1/ 
e9aa60c60128: Pulling dependent layers 
e9aa60c60128: Pulling metadata 
e9aa60c60128: Pulling fs layer 
e9aa60c60128: Downloading 532.3 kB
e9aa60c60128: Download complete 
hello
```

With the following /etc/docker-certs
```
{
    "roots": ["/etc/pki/tls/certs/ca-bundle.crt", "/etc/pki/tls/certs/localhost.crt"],
    "hosts": {
	"127.0.0.1":  {
	    "cert": "/home/alex/client.cert",
	    "key": "/home/alex/client.key"
	}
    }
}
```
is an example of one...