Refactor NewClientCertificateCredential

[chlowell]

This PR refactors NewClientCertificateCredential to take a slice of certificates and a private key instead of raw certificate data, and adds a helper method to simplify acquiring those in common cases. My motivation is primarily to avoid future problems around encrypted keys. There are many ways to encrypt a certificate's key, and the standard library doesn't support all of them. For example, its method for decrypting legacy PEM encryption is deprecated. Taking only raw cert data may oblige us to support such encryption schemes by writing our own decryption code or adding an external dependency, and asking customers to adopt an ugly workaround in the meantime.

before

certData, err := os.ReadFile("/cert.pem")
cred, err := NewClientCertificateCredential(tenantID, clientID, certData, password, nil)

after

certData, err := os.ReadFile("/cert.pem")
certs, key, err := LoadCerts(certData, password)
cred, err := NewClientCertificateCredential(tenantID, clientID, certs, key, nil)

LoadCerts handles common cases and can become more comprehensive over time; its capabilities are an implementation detail.

[richardpark-msft]

Not too familiar with identity. Just some minor comments.

[richardpark-msft]

Just some comments, looks good to my untrained eye.

[richardpark-msft]

I do miss the more descriptive name. I know there's reasons, but still. :)

[richardpark-msft]

Looks good, one little nit with an error message.