pkg/certsigner/signer: Add "client" usage to server profile

Avoid issues like [1]:

  WARNING: 2018/05/29 11:17:10 Failed to dial 127.0.0.1:2379: connection error: desc = "transport: authentication handshake failed: remote error: tls: bad certificate"; please retry.

In the discussion there, the issue seems to be that etcd 3.2 started
requiring the client usage for the server cert, which is (for some
reason) used when connecting to the gRPC gateway [2,3].

[1]: etcd-io/etcd#9785 (comment)
[2]: etcd-io/etcd#9785 (comment)
[3]: https://github.com/etcd-io/etcd/blob/v3.3.10/Documentation/dev-guide/api_grpc_gateway.md

pkg/certsigner/signer.go

@@ -227,6 +227,7 @@ func signerPolicy(c Config) config.Signing {
 				Usage: []string{
 					string(capi.UsageKeyEncipherment),
 					string(capi.UsageDigitalSignature),
+					string(capi.UsageClientAuth),
 					string(capi.UsageServerAuth),
 				},
 				Expiry:       c.EtcdServerCertDuration,