decouple client certificates from authentication

This allows the usage of client certificates to be independent of
authentication.  It is possible that the usage of client certificates
eliminate the need for any authentication, or that they provide
other benifits.

This patch restructures the incoming and outgoing server setup pages
so that client certificates can be set as long as the connection uses
TLS/SSL.  If the user chooses client certificates for authentication
it will prompt for certificate only if there isn't one already set.

Mixing password and client certificates works, and this builds upon
other work that allows these settings to coexist in the imap/smtpURI.

This also give the certificate spinner a little more polish.
  - label looks like other labels
  - some indentation
  - the cancel button only appears if there is something to cancel