Add remote signing and consolidate remote cert generation

* CFSSL now accepts a "remote" parameter in the signature and new
  certificate requests. This remote parameter may specify a remote
  CFSSL instance to perform the signature operation. In the case
  of new certificate generation, the private key remains on the
  originating CFSSL instance.

* The "remotecert" endpoint has been removed in favour of the
  following approach.

* The remote argument now applies to the serve command. If supplied,
  both the signing API and certificate generation endpoints will
  automatically ship out signature requests to this remote without
  clients having to supply a "remote" parameter. Note that the
  "remote" parameter overrides this option.