Implement Smartcard/CAC Authentication in GitLab

Add support for Smartcard (CaC) authentication via LDAP.

All major browsers support Smartcard authentication by forwarding the Smartcard certificate to the requested web server.

https://help.ubuntu.com/community/CommonAccessCard#Firefox
NGINX can be configured to forward a ssl_client_certificate from an attempted Smartcard authentication

http://geocentlabs.com/configure-nginx-for-ssl-with-dod-cac-authentication-on-centos-6-3/

GitLab could retrieve the Smartcard certificate from the request headers and verify this against a certificate stored in Active Directory (via LDAP).

Adding to this issue to include any kind of access tokens (whether it be Smartcard authentication or PKI-based browser certs).

First iteration:

Authenticating with a card with a single certificate, mapped to a single user. Create user if not found, or login with existing credentials if found.
GitLab authentication only, no LDAP in this iteration.
Omnibus package only.

We'll need additional issues for multi user/cert, LDAP, and other distros.

SFDC links: