fix deprecated ssl_client_cert. add ssl_client_verify header

[auhlig]

(1) The ssl_client_cert header is deprecated. Use ssl_client_escaped_cert instead. Reference
(2) Setting the ssl-client-verify header allows client certificate verification. See docs

[k8s-reviewable]

This change is 

[coveralls]

Coverage remained the same at 33.492% when pulling 788eb58 on sapcc:sso into 1f269d4 on kubernetes:master.

[rikatz]

LGTM.

@auhlig does the new $ssl_client_escaped_cert; changes the Cert format passed to the backend? Will the apps using this variable need to be changed, or this is the same behaviour as the old one?

[aledbf]

/lgtm