system-test: refactor custom host certificate support

This patch refactors and hopefully simplifies the host credential
support within system-test.

Although the patch modifies the hostCredential and, to a minor
extent, the populate script, the default system-test build is not
changed.  A host credential is stored in git that support 'localhost'
connections.  This is used by default.  Therefore the system-test
continues to work without storing any files externally.

As currently, the hostCredential utility can create host credentials,
either 'localhost'-only or with SubjectAlternativeName that match all
discovered possible FQDNs for the host.  The 'localhost'-only
certificate allows easy renewing of the git-stored credential.  The
SAN certificate is to allow some clients that use the Globus GSI
library to work correctly (gSOAP-based ones, but potentially others,
too).

The difference is that, in addition to storing the certificate in the
target/dcache directory, it is also stored in ~/.globus directory.
The populate script has been updated so that, if it detects a stored
host credential in ~/.globus, this is used in preference to the
git-stored credential.

Previously hostCredential required the --install option in addition
to the --generate option to trust the generated certificate.  Now,
this is implied: the script ensures that the generated certificate is
trusted.

The --clean command is added.  This removes all files in ~/.globus
directory that the command installs.  After running this command, the
system-test build will use the git-stored host credential.

The --install command installs all unknown certificates and
signing-policy files in ~/.globus/certificates.  This is similar to
what is does currently, but now it does this so that that installed
files may be deleted later on (by --clean)

The populate script continues to check if dCache-trusted certificates
are trusted by the user.  The output if one or more files are missing
has changed: rather than listing the missing files with instructions,
the developer is told to use 'hostCredential --trust' to fix the
problem.

If a dCache-trusted certificate is trusted by the developer, the
populate script checks that they are byte-wise identical files.  This
test is useful if the Disposable CA changes (e.g.,
'localhost'-certificate is renewed) as the filenames will remain the
same but have different contents.

Target: trunk
Requires-note: no
Requires-book: no
Patch: http://rb.dcache.org/r/5705
Acked-by: Gerd Behrmann