Bazel downloader should support `--tls_client_certificate` and `--tls_client_key`

Description of the feature request:

The command line options --tls_client_certificate and --tls_client_key currently only work with Bazel remote cache and remote execution. They should also be supported by Bazel downloader to authenticate with a protected server.

The discussion https://github.com/bazelbuild/bazel/discussions/19560 discusses a workaround modifying the Bazel JVM and providing a special keystore. However, that's tedious and should be unnecessary given that the command line options already exist.

Which category does this issue belong to?

No response

What underlying problem are you trying to solve with this feature?

mTLS authentication to a protected server for all Bazel downloads/fetches

Which operating system are you running Bazel on?

No response

What is the output of bazel info release?

No response

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse HEAD ?

Have you found anything relevant by searching the web?

No response

Any other information, logs, or outputs that you want to share?

No response