Improve Certificate Handling for OIDC

[da1910]

When using OIDC it's generally expected that resources will be protected by SSL/TLS. Frequently these resources will have either self-signed certificates, or certificates signed by a corporate/internal authority.

At the moment we expose a cert_bundle_path option in our Configuration class, which allows the use of self-signed certificates. Providing this, however, overrides all normally trusted certificates, meaning that frequently the Identity Provider becomes untrusted as far as the library is concerned.

As a workaround I have been reading the certifi bundle into memory, appending our self-signed certificate, then writing the new bundle out. We could do this to a temporary file somewhere. We could also investigate whether we can provided an IOBase object to requests/urllib?

[Andy-Grigg]

The python-certifi-win32 package is a nice workaround for windows.

EDIT: Turns out https://pypi.org/project/pip-system-certs/ is the replacement, and based on the name at least it might be cross-platform