Add support for --os-cacert

Handle --os-cacert and OS_CACERT to supply CA root certificate.  This is the
same semantics used by the other core clients.

Change-Id: I63a204d3f0a481b87f8795b5681a3db35fb3e503