Don't ignore system cert error

[absoludity]

Following up on a comment https://github.com/kubeapps/kubeapps/pull/1125/files#r315253073 this ensures that we don't swallow an error unnecessarily when getting the system certs.

So that I don't break anyone's test environment, an empty pool of certs can be explicitly allowed if necessary.

[andresmgot]

I would do it a bit different, mostly because TILLER_PROXY_ALLOW_EMPTY_CERT_POOL suggest for me that it's going to at least try to load the cert pool:

	caCertPool, err := x509.SystemCertPool()
	if err != nil {
          if _, ok := os.LookupEnv("TILLER_PROXY_ALLOW_EMPTY_CERT_POOL"); !ok {
            return nil, err
          }
          caCertPool = x509.NewCertPool()
        }

[absoludity]

Yeah, I had it that way first, but then the optimizing demon in my head wondered whether SystemCertPool() is more expensive (ie. whether NewCertPool() is just a memory allocation. But you're right in that it's premature... the code is clearer when it matches the env var. Switched.

[absoludity]

This required removing the tests I'd added too - as I can't force or mock x509.SystemCertPool() easily (runtime.GOOS is a const). Not sure it matters.