Set (*tls.Certificate).Leaf from the tlsconfig.GetCertificate callback

[jpeach]

The Leaf field can be set to a pre-parsed *x509.Certificate, which I believe we should already have from the SVID.

So something like this should remove the need for an additional certificate parse:

diff --git v2/spiffetls/tlsconfig/config.go v2/spiffetls/tlsconfig/config.go
index 0ef3969..a5706ea 100644
--- v2/spiffetls/tlsconfig/config.go
+++ v2/spiffetls/tlsconfig/config.go
@@ -221,6 +221,7 @@ func getTLSCertificate(svid x509svid.Source, trace Trace) (*tls.Certificate, err
        cert := &tls.Certificate{
                Certificate: make([][]byte, 0, len(s.Certificates)),
                PrivateKey:  s.PrivateKey,
+               Leaf:        s.Certificates[0],
        }

        for _, svidCert := range s.Certificates {