Support certificate based authentication

[idg10]

When authenticating via AAD as a service principle, Microsoft recommends avoiding client secret authentication where possible, preferring the use of a client certificate.

That's not always possible, because making client certificates available presents various deployment challenges. However, since it's the mode that Microsoft recommends, we should support it.