add support for rfc9440 cert headers

[jessepeterson]

Per the updated operations guide:

With the -cert-header switch you can specify the name of an HTTP header that is passed to NanoMDM to instead read the client identity certificate from. The format of the header is parsed as RFC 9440 if it begins with a colon, otherwise a URL query-escaped PEM certificate is assumed.

RFC 9440 specifies a Base-64 encoded DER certificate surrounded by colons. The URL query-escaped PEM certificate is ostensibly to support Nginx' $ssl_client_escaped_cert in a proxy_set_header directive. Though any reverse proxy setting similar headers can be used, of course. Again the SignMessage key in the enrollment profile should be set appropriately (i.e. to false or not set, if you're using this switch).

NOTE
NanoMDM v0.7.0 and below do not support RFC 9440 header parsing, only URL query-escaped PEM certificates.