Add masquerades

I am more and more convinced that having all these cert files in the certs/ folder is a bad idea, but I didn't want to make any changes that were not essential to making this work.

Since this diff is noisy, let me summarize the relevant changes:
- add `addmasquerades.py`
- in `config/config.go`, segregate cloudflareMasquerades out to a different module, the source of which is generated programmatically by the abovementioned script.

If you merge this, please run the `updateyaml.bash` script to upload the new sites to S3.