Improve build-ca overwrite protection

Refuse to run build-ca when $PKI_DIR/private/ca.key exists, even if the
PKI or CA structure is incomplete. This prevents inadvertent loss of a
generated keypair.
Support nsCertType values for client and ca type certs

When the deprecated NS_SUPPORT is enabled, include the field for client
and ca cert types, not just the server type. This allows for maximum
flexibility in validation systems relying on this support.