(SERVER-39) Allow a certificate to be passed into a request via X header

This commit adds the ability for a certificate to be supplied in a web
request as the payload of a custom HTTP header, X-Client-Cert.  The
header will only be parsed for a value if the `allow-header-cert-info`
master setting is set to true.  When the certificate is retrieved, it
will be supplied as the client certificate to the Ruby request handler
stack, as a direct replacement for a certificate object that would be
typically be provided over SSL.
In the Apache world, they have different environment variables for the end client cert, `SSL_CLIENT_CERT`, vs. the chain of trust from which that cert derives, `SSL_CLIENT_CERT_CHAIN`.  I don't see any evidence that the SSL_CLIENT_CERT_CHAIN environment variable was honored in the Puppet Rack handler.  The content of the client certificate / certificates in the Puppet Server world is opaque up to the point where consuming code in Ruby makes calls on the `Puppet::SSL::Certificate` object, e.g., `custom_extensions`.

I would expect for the most part that just the end cert would appear in the header.  I mostly put this code in just as error handling to process a certificate in the event that a chain is provided.  It seemed reasonable to me to pull the first certificate in the event a chain is present because that "should" be the end certificate.  That's how they appear in all-in-one chain files, for example, the format that Apache uses for all-in-one server certificates.

We could be more forceful about this by failing out if more than one cert is in the string but that didn't seem right.  What do you think?