Fix sampleconfig script to be compat with openssl 0.9.8
Add flag to control chain in scep getcacert response

The standard is a bit vague but as most clients seem to expect the
root cert in the getcacert response we now include it by default.
For enhanced security, you can strip it from the chain setting a
config flag.