system-test: add ability to autogenerate host credentials

The system-test module creates a self-contained dCache instance.  It
does, however, require a host certificate, which currently is stored
in git.  The certificate was signed by a throw-away CA.

The host certificate stored in git makes use of the Globus
non-standard "host-certificate" extension ("CN=host/<name>").  This,
together with the lack of any subjectAltName extension means that only
Globus software will accept the host certificate.

Also, since the process for generating the certificate wasn't
documented, when the certificate runs out, generating a new
certificate may take some effort to create.

This patch adds support in the populate script for generating a
suitable host-certificate using OpenSSL.  The script
hostCredentials can generate a CA credentials, generates the host
credentials and installs the CA certificate, CA signing_policy and
host credentials, throwing away the CA private key.

By default, the host certificate has various DNS subjectAltName,
but if the --only-localhost option is specified then only
DNS:localhost is uesd.

The --install option will install the generated CA files in
~/.globus/certificates, so trusting the throwaway CA.

Target: master
Patch: https://rb.dcache.org/r/5529/
Acked-by: Gerd Behrmann

This patch adds support for generating the required host-certificate
using OpenSSL.  The process is triggered by running an extra script.
The script may also be used to install the trusted CA.