Add support for wildcard certificates in 'pki'

- directories 'host/certs' and 'host/combined' have been removed, and
  directory 'host/signed' has been added instead. It's purpose is to hold
  host certificates signed by CA;

- directories 'ca/combined' and 'ca/private' have been removed;

- added 'wildcard/*' directory structure in '/srv/pki/'. These
  directories are meant to hold wildcard certificates, like *.example.org;

- in 'pki' role there's a variable 'pki_wildcard' which controls, if
  wildcard certificates and keys should be copied to a remote host, true
  by default. Using that you can limit which hosts get wildcard
  certificates and which don't;

- nginx SSL certificate logic in default template has been updated to
  support new host certificate directories and wildcard certificates;