Consider the PIP_CLIENT_CERT value when creating the requests session.

[matteius]

Fixes #5746

The issue

When we introduced the pep508 package index url checks for determining package hashes, it broke users that rely on client side certificates when locking.

The fix

Consider how the users were supplying client side certs with PIP_CLIENT_CERT and pass it to the requests session as well.

The checklist

• Associated issue
• A news fragment in the news/ directory to describe this fix with the extension .bugfix.rst, .feature.rst, .behavior.rst, .doc.rst. .vendor.rst. or .trivial.rst (this will appear in the release changelog). Use semantic line breaks and name the file after the issue number or the PR #.