Jrbl basically working multi certs

@jbau, please

This is an evolution of what you've already seen (and helped me debug). This branch implements a bulk certification mechanism (without mass mailing) using PDFKit to drive wkhtmltopdf. It requires two input files: one listing usernames that should never get certs, and another more complicated json file that describes certification criteria. If the CourseCertificate entries for a particular described certificate don't exist yet, they'll be created at runtime, so the create_cert step from the xhtmltopdf days is eliminated.

I've made an effort to cache as much as made sense in memory to avoid duplicated work, so that the PDF generation step can be given to celery and the worker(s) can just blast over it. Except at this point there's no .delay. call in there yet.

Note that I've added some command-line flags to make debugging simpler: -P skips PDF generation, -D gives pretty verbose debug output, and -s runs certification for a single user - useful for testing and also for catchup if we need to spot-update users later.

You can test with the cert assets that have been floating around the mailing list, but I've templatized Giulio's latest stuff (sans signature) and will upload a tarball to Google Drive either later tonight or early tomorrow so you can test with the real deal.